# sDAO: reward accounting inflated via LP pair transfer

sDAO staking reward accounting could be inflated by transferring tokens to the LP pair, letting attacker drain ~$13k via getReward.

- Payout: Real-world hack
- Severity: high
- Program: - sDAO
- Analysis by: DeFiHackLabs
- Disclosed: 2022-11-21
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-11/SDAO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221121-sdao
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** sDAO staking contract
**Root cause:** Reward-per-token accounting (totalStakeReward vs lastTotalStakeReward) can be manipulated by pushing SDAO tokens into the LP pair, inflating the attacker's pending reward before getReward().
**Steps:**
1. Flash loan 500 USDT from DODO.
2. Swap 250 USDT to SDAO via PancakeSwap router.
3. Add USDT/SDAO liquidity to obtain LP tokens.
4. Call `SDAO.stakeLP(Pair.balanceOf(this)/2)` to stake LP.
5. Transfer remaining SDAO to the Pair via `SDAO.transferFrom(this, Pair, balance)` to push totalStakeReward above lastTotalStakeReward.
6. Call `SDAO.withdrawTeam(address(Pair))` and send 13e15 to SDAO.
7. Call `SDAO.getReward()` to claim inflated rewards.
8. Swap SDAO back to USDT and repay 500 USDT flash loan.
**Exploitation:** Attacker flash-borrowed 500 USDT, acquired SDAO and LP tokens, staked, then manipulated the reward accounting by transferring SDAO into the LP pair and calling withdrawTeam, then getReward to extract inflated rewards, swapping back to USDT and repaying the loan for ~$13k profit.
**Insight:** Reward-per-token staking contracts that read pool balances (LP pair reserves) as part of reward math can be inflated by donating tokens to the pair; check whether totalStakeReward/lastTotalStakeReward deltas are attacker-controllable via direct transfers.