# Funds may be stolen by calling onMoreFlashLoan() directly Crit/High · Three Sigma · Lending · 2nd December 2024 Finding 3S-MORE-C01 of the MORE Optimizer security review. - Protocol: https://www.more.markets/ - Report: /reports/more-optimizer - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-12-02-more-markets.pdf --- ### Description LoopStrategy::onMoreFlashLoan() does not validate that the caller is the market, which allows attackers to steal collateral by calling it directly. ### Recommendation Revert if the caller is not markets. ### Status Addressed in [#7d71809](https://github.com/MoreLabsXYZ/MORE-Optimizers/commit/7d718093aafb2a036620fb36e82568ce9bdc43ed). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Users can claim tokens in ConnextRouter by calling xReceive(...) directly](https://0xsimao.com/findings/fuji-finance-claim-connext-calling-directly): Fuji Finance - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System - [NFTs can be stolen by calling send() and receiving the nfts in another chain](https://0xsimao.com/findings/metazero-i-stolen-send-receiving-nfts): MetaZero Omnichain NFTs - [TOFT in (m)TapiocaOft contracts can be stolen by calling removeCollateral() with a malicious removeParams.market](https://0xsimao.com/findings/tapioca-dao-toft-stolen-collateral-params): Tapioca DAO