# Umbrella Network StakingRewards underflow drains LP tokens

Umbrella Network StakingRewards withdraw lacked underflow check, letting attacker drain LP tokens by withdrawing more than staked.

- Payout: Real-world hack
- Severity: high
- Program: Umbrella Network
- Analysis by: DeFiHackLabs
- Disclosed: 2022-03-20
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-03/Umbrella_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220320-umbrella
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** StakingRewards contract
**Root cause:** The _withdraw function subtracts amount from _balances[user] without SafeMath, allowing underflow when amount exceeds balance.
**Steps:**
1. Call `StakingRewards.withdraw(8_792_873_290_680_252_648_282)` on contract 0xB3FB1D01B07A706736Ca175f827e4F56021b85dE without staking any tokens.
2. The underflow in `_balances[user] = _balances[user] - amount` wraps to a huge balance, and the contract transfers LP tokens to the attacker.
**Exploitation:** Attacker called withdraw with a huge amount, triggering underflow and draining LP tokens from the StakingRewards contract.
**Insight:** Staking contracts using raw subtraction without SafeMath are vulnerable to underflow; check for unchecked arithmetic in reward/staking logic.