# Anyone can deposit to DarkpoolAssetManager as the owner can be freely chosen without any implication Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-H06 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description [DarkpoolAssetManager::depositETH()](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/core/DarkpoolAssetManager.sol#L129-L132) and [DarkpoolAssetManager::depositERC20()](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/core/DarkpoolAssetManager.sol#L89-L92) allow choosing any owner, while the msg.sender still receives the deposit. ### Recommendation The owner should be the msg.sender or the owner's signature should be validated (so it can be relayed). ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934).