# UEarnPool: referral team-reward farming drains pool via flash loan

UEarnPool referral reward logic let an attacker spin up 22 interlinked contracts, stake USDT to hit top team tier, and drain ~$24k in team rewards via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: - UEarnPool
- Analysis by: DeFiHackLabs
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-11/UEarnPool_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221117-uearnpool
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** BSC staking/referral reward contract (claimTeamReward, bindInvitor, stake)
**Root cause:** claimTeamReward computes level rewards from teamAmount thresholds and rewardRate without verifying genuine downline stake or preventing self-referential invite chains, so a single actor fabricating a team can claim all tier rewards.
**Steps:**
1. Deploy 22 claimReward contracts via create2 with distinct salts.
2. contractList[0].bind(tx.origin); for i in 1..21: contractList[i].bind(contractList[i-1]) to form an invite chain.
3. Flash-borrow 2,420,000 USDT from PancakeSwap pair `0x7EFaEf62fDdCCa950418312c6C91Aef321375A00` via `Pair.swap(2_420_000e18, 0, address(this), data)`.
4. In pancakeCall: transfer 2,400,000 USDT to contractList[21] and call `stakeAndClaimReward(2_400_000e18)` to reach _levelConfigs[3].teamAmount.
5. Loop i from 20 down to 5: transfer 20,000 USDT to contractList[i], top up pool to 143,500 USDT if balance lower, call `stakeAndClaimReward(20_000e18)` then `withdraw(address(this))`.
6. Withdraw from contractList[0..4] to collect invite rewards.
7. Repay flash loan: `USDT.transfer(Pair, borrowAmount*10_000/9975 + 1000)`.
8. Keep remaining USDT as profit (~$24k).
**How found:** Analysis of claimTeamReward reward formula and _levelConfigs thresholds revealed that teamAmount is derived from staked amounts of invitees, which the attacker fully controls, allowing a self-built downline to unlock every tier reward.
**Exploitation:** Flash loan 2.42M USDT from PancakeSwap; use it to fund a fabricated 22-contract referral tree that satisfies the top levelConfig teamAmount threshold; each contract stakes and claims team rewards, then withdraws USDT back to the attacker; loan repaid, net ~$24k extracted from the pool's reward balance.
**Insight:** When a reward formula keys off aggregate downline stake (teamAmount) rather than per-user verified stake, an attacker can fabricate the entire downline with throwaway contracts and a flash loan to hit the top tier and harvest all tier deltas in one transaction.