# Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after Crit/High · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-H07 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description The BaseRouter checks if the initial balance of the tokens interacted with is the same as the end balance. However, for vaults, it only checks the balance of the underlying asset, not the shares themselves. Thus, for example, when a user makes a deposit action and specifies the BaseRouter as the receiver, but does not do any further action, the shares will be locked in the BaseRouter. Then, an attacker can call the withdrawal action of the BaseRouter and redeem these shares for any receiver. ### Recommendation Add to the tokensToCheck array the address of the vault itself (its shares). ### POC https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCAttackerStealsUser.t.sol#L40 ### Status Addressed here: [Fujicracy/fuji-v2#622](https://github.com/Fujicracy/fuji-v2/pull/622) --- Related findings: - [Metadata is not set in Cap, which is required by the inherited Router to specify gas limit to the mailbox](https://0xsimao.com/findings/mitosis-metadata-inherited-gas-mailbox): Mitosis - [Decimals of LendingPool don't take into account the offset introduced by VIRTUAL_SHARES](https://0xsimao.com/findings/init-capital-ii-decimals-introduced-virtual-shares): INIT Capital - [Attackers will steal the reserve from the `Vault` by receiving `ra` in `FlashSwapRouter::__swapDsforRa()`](https://0xsimao.com/findings/cork-protocol-steal-receiving-flash-dsfor): Cork Protocol - [Attackers can include other users nullifiers to make their funds stuck when adding liquidity to curve](https://0xsimao.com/findings/singularity-include-nullifiers-stuck-curve): Singularity