# BXH staking: flashloan price manipulation drains USDT rewards

BXH staking pool's deposit() credited rewards based on manipulable BXH/USDT pool price, letting an attacker flashloan, pump BXH, deposit, and drain $40k USDT.

- Payout: Real-world hack
- Severity: high
- Program: BXH
- Analysis by: DeFiHackLabs
- Disclosed: 2022-09-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-09/BXH_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20220928-bxh
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** TokenStakingPoolDelegate staking contract on BSC
**Root cause:** The staking pool's deposit/reward accounting relied on the spot price of the BXH/USDT PancakeSwap pair, which the attacker could move within a single transaction via a large swap.
**Steps:**
1. Flashloan 3,178,800 USDT from the WBNB/USDT Pancake pair via `swap(3178800000000000000000000, 0, address(this), "0x")`
2. In `pancakeCall`, approve BXH router and swap most USDT for BXH via `swapExactTokensForTokensSupportingFeeOnTransferTokens`, pumping BXH price
3. Transfer 805.6 USDT to the staking contract and call `bxhtokenstaking.deposit(0, 0)` as the attacker EOA to trigger reward accounting at the inflated BXH price
4. Withdraw the credited USDT from the staking contract back to the attacker
5. Swap BXH back to USDT on the BXH router
6. Repay the flashloan plus 0.26% fee to the WBNB/USDT pair
**How found:** PoC reproduces the on-chain attack; the reasoning is that the staking pool prices deposits/rewards off a manipulable AMM spot pair, so a flashloan-funded swap can skew it atomically.
**Exploitation:** Attacker flash-borrowed ~3.18M USDT, used it to buy BXH on the BXH router inflating BXH's price, deposited a tiny amount into the staking pool so rewards were computed at the manipulated price, withdrew the inflated USDT reward, sold BXH back, and repaid the flashloan, netting ~$40k.
**Insight:** When a staking/reward contract reads a token's price from a single Pancake/Uniswap spot pair, a flashloan swap in the same tx can inflate the reward credit; check whether deposit() or pending() calls getReserves or a router quote.