# DYNA staking: reward inflation via deposit/redeem loop

DYNA staking contract had a business logic flaw allowing repeated deposit/redeem to inflate rewards, exploited for ~$21k via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: - DYNA
- Analysis by: DeFiHackLabs
- Disclosed: 2023-02-22
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-02/DYNA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230222-dyna
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** Staking contract on BSC
**Root cause:** The staking contract's reward calculation allowed an attacker to repeatedly deposit and redeem large amounts within the same transaction, inflating rewards due to a flaw in reward accounting.
**Steps:**
1. Deploy 200 StakingReward contracts, each depositing 5 DYNA (1000/200) to become stakers.
2. Transfer 1 wei DYNA to the PancakeSwap pair and 0.1 DYNA to tx.origin to bypass sold amount limit.
3. Warp time by 7 days to accrue rewards.
4. Flash loan all DYNA from the pair via `Pair.swap(flashLoanAmount, 0, address(this), new bytes(1))`.
5. In the callback, for each StakingReward contract: transfer all DYNA to it, call `deposit(amount)`, then `withdraw(amount)` to claim inflated rewards.
6. Repay flash loan with `DYNA.transfer(address(Pair), flashLoanAmount * 100_000 / 9975 / 9 + 1000)`.
7. Swap remaining DYNA to WBNB via PancakeSwap router.
**Exploitation:** Attacker used a flash loan to borrow DYNA from a PancakeSwap pair, then cycled deposits and withdrawals through 200 staking contracts to inflate rewards, repaid the loan, and swapped profit to WBNB.
**Insight:** Reward-bearing staking contracts that allow deposit and redeem in the same transaction can be exploited by flash-loaning large amounts and looping through many staking contracts to amplify reward accrual.