# MooCAKECTX: flash-loan harvest manipulation drains vault

Flash-loan exploit manipulated Beefy Syrup strategy harvest to inflate CAKE share price, letting attacker borrow cheaply and drain ~$140k from MooCAKE.

- Payout: Real-world hack
- Severity: high
- Program: MooCAKECTX
- Analysis by: DeFiHackLabs
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-11/MooCAKECTX_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221107-moocakectx
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** Beefy Syrup strategy / Venus lending market on BSC
**Root cause:** Beefy Syrup strategy harvest() could be triggered by anyone and its share-price accounting was manipulable within a single transaction, letting an attacker inflate vault share value and borrow against it via Venus.
**Steps:**
1. Flash-loan 400k BUSD from DODO.
2. enterMarkets on vBUSD and vCAKE via Unitroller.
3. Mint BUSD into vBUSD, borrow 50k CAKE from vCAKE.
4. depositAll() into Beefy vault, then trigger StrategySyrup.harvest() to swap CAKE->WBNB and inflate share price.
5. withdrawAll() from Beefy vault to realize inflated CAKE.
6. repayBorrow 50k CAKE, redeemUnderlying 400k BUSD, repay DODO.
**How found:** On-chain analysis of the exploit tx identified the harvest() call as the price-manipulation primitive inside the vault deposit/withdraw cycle.
**Exploitation:** Attacker flash-borrowed 400k BUSD, supplied to Venus, borrowed CAKE, deposited into Beefy vault, called harvest() to manipulate share price, withdrew inflated CAKE, repaid borrow, redeemed BUSD and repaid flash loan, keeping profit in CAKE.
**Escalation:** Chained Venus lending + Beefy vault + Syrup strategy harvest in one tx to amplify borrowed capital.
**Insight:** Vault strategies whose harvest() is permissionless and whose share price depends on same-block swap output are manipulable via flash loans; check deposit->harvest->withdraw sequences for share inflation.