# RL Token: incorrect reward calculation drained via flash loan

RL Token's airdrop reward contract miscalculated rewards, letting an attacker flash-loan, add liquidity, and claim inflated airdrops across 100 contracts to drain funds.

- Payout: Real-world hack
- Severity: high
- Program: RL Token
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-01
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/RL_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221001-rl
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:accounting-error vuln:reward-distribution

**Target:** RLLpIncentive airdrop distribution contract on BSC
**Root cause:** The distributeAirdrop function calculated rewards incorrectly, likely based on current liquidity or balance rather than a fixed snapshot, allowing repeated claims with inflated rewards.
**Steps:**
1. Flash loan 450,000 USDT from DODO.
2. Swap 150,000 USDT for RL tokens and add liquidity to the RL/USDT pair.
3. Deploy 100 AirDropRewardContract instances via CREATE2.
4. For each contract, transfer LP tokens and call `airDropReward(address)` which invokes `RLL.distributeAirdrop(address(this))` to claim rewards.
5. Remove liquidity and sell RL tokens for USDT.
6. Repay flash loan and keep profit.
**Exploitation:** Attacker used a DODO flash loan to acquire USDT, bought RL tokens, added liquidity to the RL/USDT pair, then deployed 100 contracts that each called distributeAirdrop to claim inflated rewards. After claiming, they removed liquidity and sold RL, repaying the flash loan and keeping the profit.
**Escalation:** Deploying 100 contracts multiplied the reward claims, amplifying the drained amount.
**Insight:** Airdrop reward functions that calculate rewards based on current liquidity or token balances can be gamed by temporarily adding liquidity and claiming across multiple addresses; check for reward calculations that use manipulable state.