# NFTXLPStaking Is Subject To A Flash Loan Attack That Can Steal Nearly All Rewards/Fees That Have Accrued For A Particular Vault

NFTXLPStaking pays rewards proportional to stake size with no lockup or duration tracking, so a flash-loaned deposit can claim nearly all accrued vault rewards.

- Payout: Audit contest
- Severity: high
- Program: NFTX
- Disclosed: 2021-06-21
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-05-nftx-findings/issues/88
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-nftx%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** NFTXLPStaking staking/rewards contract
**Root cause:** LPStaking requires no lockup and does not track stake duration, so rewards are awarded purely on stake size at claim time; a flash-loaned deposit dwarfs legitimate stakes and captures nearly all accrued rewards.
**Steps:**
1. Wait until an NFTX vault has accrued significant fees/rewards
2. Flash-loan a large amount of ETH from a generic provider
3. Flash-loan a large amount of nftx-vault-token via `NFTXVaultUpgradeable.flashLoan()`
4. Add ETH and vault tokens to Uniswap via `Uniswap.addLiquidity()` to get LP tokens
5. Stake LP tokens via `NFTXLPStaking.deposit()`
6. Claim nearly all accrued rewards via `NFTXLPStaking.claimRewards()`
7. Remove LP tokens via `NFTXLPStaking.exit()`
8. Withdraw ETH and vault tokens via `Uniswap.removeLiquidity()`
9. Repay nftx-vault-token flash loan
10. Repay ETH flash loan
**How found:** Code review noting LPStaking lacks any lockup or stake-duration tracking, so stake size alone determines reward share; combined with the vault's built-in flashLoan function.
**Exploitation:** All steps execute in one transaction: flash-borrow ETH and vault tokens, mint Uniswap LP, deposit into NFTXLPStaking, claim rewards sized to the huge flash deposit, exit, remove liquidity, repay loans, keeping the rewards.
**Escalation:** NFTXVaultUpgradeable's native flashLoan makes borrowing vault tokens trivial, removing the need for external liquidity.
**Insight:** Reward accounting based on instantaneous stake size without duration weighting or lockup is flash-loanable; check whether deposit/claim/withdraw can all occur in one transaction and whether the protocol itself offers a flashLoan primitive to bootstrap the stake.