# DBW: LP-share dividend logic farmed via cloned contracts

DBW dividend rewards computed from current LP share let attacker pledge/redeem LP across 18 cloned contracts to farm static income repeatedly, draining $24k.

- Payout: Real-world hack
- Severity: high
- Program: - DBW
- Analysis by: DeFiHackLabs
- Disclosed: 2023-03-25
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-03/DBW_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230325-dbw
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** BEP-20 staking/dividend contract with pledge_lp/getStaticIncome/redemption_lp
**Root cause:** Dividend awards are based on the percentage of LP the user currently owns and do not account for multiple dividend claims after LP transfer, so LP can be pledged, rewarded, redeemed and re-pledged from many addresses.
**Steps:**
1. Flash-loan USDT from dodo1-4 and a Uniswap V2 pair (chained DPPFlashLoanCall/hook).
2. Swap USDT to DBW and add liquidity via Router to obtain Pair LP tokens.
3. Deploy 18 miniProxy clones via create2, each transferring LP in and calling claimRewardImpl.exploit().
4. In exploit(): `DBW.getStaticIncome()`, `vm.warp(block.timestamp + 2*24*60*60)` to bypass locktime, `DBW.pledge_lp(LPAmount)`, `DBW.getStaticIncome()` to claim reward, `DBW.redemption_lp(LPAmount)`, then return LP.
5. Remove liquidity, swap DBW back to USDT, repay flash loans.
**How found:** Analysis noted dividend payout depends on current LP ownership percentage and ignores repeated claims after LP transfer, enabling repeated pledge/claim/redeem cycles.
**Exploitation:** Attacker flash-borrowed large USDT, seeded DBW/USDT liquidity, then used 18 create2-deployed miniProxy contracts each delegatecalling the reward exploit to pledge LP, warp past the 2-day lock, claim static income, and redeem LP. Rewards accumulated across clones, then liquidity was removed and swapped back to USDT, netting ~$24k.
**Escalation:** Scaling via 18 cloned contracts each independently claiming dividends on the same underlying LP position.
**Insight:** When a staking/dividend contract snapshots 'current LP share' rather than tracking per-deposit accounting, test whether LP can be pledged, rewarded, redeemed and re-pledged from many freshly deployed addresses within one transaction, and whether lock timers can be bypassed by timestamp manipulation in a fork.