# In BaseRouter, the beneficiary isn't checked when starting a flashloan action and it replaces the previous beneficiary Crit/High · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-C01 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description When doing a flashloan action in the BaseRouter.sol the beneficiary isn't compared with the beneficiary of the previous action, and the variable gets replaced with the beneficiary for the flashloan, this can lead to a beneficiary change, which could lead to stolen assets. For example, using 3S-FUJI-M10, it is possible to withdraw for another user, use a flashloan to change the beneficiary to the attacker's address and use the funds withdrawn with 3S-FUJI-M10 however the attacker wishes. ### Recommendation Add a function to check the beneficiary instead of replacing. ### POC https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCAttackerChangesBeneficiary.t.sol#L111 ### Status Addressed here: [Fujicracy/fuji-v2#615](https://github.com/Fujicracy/fuji-v2/pull/615)