[Lines of code](https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/SemiFungibleVault.sol#L94) # Vulnerability details ## Impact solmate won't check if the token is a contract or not. It's possible for an attacker to the create a vault for a non existing token with a deterministic address. The problem occurs if the token gets deployed later, and another user tries to use this token, the original attacker can withdraw the vault and steal user funds. This type of attack (malicious interactions with non existing tokens) was used for the Qubit Finance hack. Check [rekt](https://rekt.news/qubit-rekt/>) and [halborn]( asset.safeTransferFrom(msg.sender, address(this), assets); asset.safeTransfer(receiver, assets); asset.transferFrom(msg.sender, address(this), shares); asset.transfer(treasury, feeValue); asset.transfer(receiver, entitledShares); asset.transfer(_counterparty, idFinalTVL[id]); ## Tools Used Manual review. ## Recommended Mitigation Steps OpenZeppelin checks the code for the token address. Pseudocode address(token).code.length > 0 Consider using OpenZeppelin or checking for contract existance manually. --- The text was updated successfully, but these errors were encountered: All reactions

Lack of check if token is a contract