# SheepFarm: missing validation lets mass-register drain funds

SheepFarm game contract lacked input validation on register/upgradeVillage, letting an attacker mass-register neighbors and upgrade villages to drain ~1 BNB via withdrawMoney.

- Payout: Real-world hack
- Severity: high
- Program: - SheepFarm
- Analysis by: DeFiHackLabs
- Disclosed: 2022-11-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-11/SheepFarm_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221116-sheepfarm
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** BSC game contract (register/upgradeVillage/withdrawMoney)
**Root cause:** The contract performed no input validation on register() and upgradeVillage(), so an attacker could register the same neighbor address 200 times and upgrade arbitrary village IDs, inflating rewards/wool accounting.
**Steps:**
1. Fork BSC at block 23088156 against SheepFarm `0x4726010da871f4b57b5031E3EA48Bde961F122aA`
2. Loop 200 times calling `sheepFram.register(neighbor)` with the same neighbor `0x14598f3a9f3042097486DC58C65780Daf3e3acFB`
3. Call `sheepFram.addGems{value: 5 * 1e14}()`
4. Loop 3 times calling `sheepFram.upgradeVillage(i)` for i=0..2
5. Call `sheepFram.sellVillage()`
6. Call `sheepFram.withdrawMoney(20_000)` and collect BNB profit
**Exploitation:** Attacker mass-registered a single neighbor address 200 times and upgraded villages, then sold the village and withdrew 20,000 wool, converting inflated in-game balance into ~1 BNB of contract funds.
**Insight:** Game/economy contracts that let you register the same referral/neighbor repeatedly without uniqueness checks let you inflate reward accounting; check whether register/referral functions enforce one-time or per-address constraints before trusting balance math.