# Mushrooms Finance Theft Of Yield Bugfix Review

Mushrooms Finance harvest could be sandwiched via flashbots MEV bundle, distorting a Uniswap pool to skim a portion of yield; exploited twice for ~$222.

- Payout: $4,000
- Severity: high
- Program: Mushrooms Finance
- Credited: Wen-Ding Li
- Disclosed: 2021-05-20
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/mushrooms-finance-theft-of-yield-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-mushrooms-finance-theft-of-yield-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:high tech:evm technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** DeFi yield-farming harvest function and Uniswap pool
**Root cause:** Harvest distributes yield based on a Uniswap pool price that an MEV searcher can distort within a flashbots bundle ordering, letting the searcher capture part of the harvest. EOA-only caller restriction did not prevent this.
**Steps:**
1. Build a flashbots bundle of three ordered txs sandwiching the victim harvest.
2. Tx1: use own funds (not flash loan) to distort the Uniswap pool price (`0xec730c75...`).
3. Tx2: Mushrooms deployer's normal harvest tx executes at distorted price (`0xa0ac048a...`).
4. Tx3: restore pool to undistorted state, capturing a portion of the harvest, and pay bribe to flashbot miner (`0x7ae34b79...`).
**How found:** Recognized that EOA-only harvest caller restriction blocks classic flash-loan harvest attacks but not flashbots bundle ordering, since a searcher can sandwich the legitimate deployer's harvest tx via mempool observation.
**Exploitation:** MEV searcher submits a flashbots bundle forcing tx ordering: distort Uniswap pool with own capital, let the victim harvest execute against the distorted pool, then unwind the pool and keep a slice of the harvest, paying the miner a bribe only on success. No flash loan used.
**Insight:** EOA-only checks on harvest don't stop MEV: if harvest output depends on a manipulable AMM pool price, a flashbots bundle can sandwich the legitimate harvest tx. Look for harvest/rebalance functions whose payout reads a spot pool price.