# Funds in the pool could be stolen by exploiting flashSwap in HybridPool

HybridPool tracks reserves via bento.toAmount; calling harvest inside the flashSwap callback raises toAmount and reduces the DAI owed, letting attacker skim pool yield.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: broccoli
- Disclosed: 2021-11-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/167
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AH-16
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** HybridPool flashSwap / BentoBox toAmount accounting
**Root cause:** HybridPool computes reserves and swap repayment using bento.toAmount, which changes when anyone calls harvest; the flashSwap callback allows harvest mid-swap, altering the amount owed.
**Steps:**
1. Identify a DAI strategy in BentoBox with unrealized profit (toAmount < actual after harvest).
2. Call `flashSwap` on DAI-WETH HybridPool borrowing DAI, receiving tokens, entering `tridentSwapCallback`.
3. Inside callback call `bento.harvest(strategy, ...)` to realize DAI profit, increasing pool's `toAmount`.
4. Repay less DAI than originally required since repayment is computed from updated toAmount; keep the WETH output.
**How found:** Code review of HybridPool reserve accounting: noticed reserves use bento.toAmount (elastic/share) rather than balanceOf, and that harvest is permissionless and callable during the flashSwap callback, making repayment manipulable.
**Exploitation:** Attacker flash-borrows DAI from the pool, harvests the underlying strategy during the callback to inflate the pool's toAmount, then repays a reduced DAI amount while keeping the swapped WETH, skimming unrealized yield.
**Insight:** When a pool derives reserves from a rebasing/share-based accounting function (toAmount/elastic) rather than balanceOf, check whether any permissionless state-changing call (harvest, rebase, sync) can be invoked inside a swap/flash callback to shift the repayment math.