# Silo Finance: interest-rate logic error drains XAI market

Silo Finance interest-rate logic error let an attacker inflate WETH borrow interest via a tiny deposit plus donation, then borrow all XAI from the market.

- Payout: Real-world hack
- Severity: high
- Program: Silo finance
- Analysis by: DeFiHackLabs
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-04/silo_finance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230427-silo-finance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Silo lending market interest accrual / share accounting
**Root cause:** Interest rate calculation used totalDeposits including donated tokens, so a direct transfer (donation) to the Silo inflated the utilization/interest rate without minting shares, letting the attacker manipulate the WETH interest rate.
**Steps:**
1. Deposit a dust amount of WETH (`1e5`) into Silo as non-collateral-only via `SILO.deposit(WETH, 1e5, false)`.
2. Directly transfer `1e18` WETH to the Silo contract address (donation, no shares minted).
3. From a second account, deposit LINK as collateral-only (`SILO.deposit(LINK, balance, true)`) and borrow `1 ether` WETH, inflating WETH interest rate.
4. Advance one block and call `SILO.accrueInterest(WETH)`.
5. Borrow the entire XAI balance held by Silo (`SILO.borrow(XAI, XAI.balanceOf(SILO))`).
**How found:** Postmortem/bugfix review of Silo's interest-rate logic; the PoC reproduces the disclosed logic error by donating tokens to the pool and observing the interest-rate manipulation.
**Exploitation:** Attacker donated WETH directly to the Silo to skew the interest-rate model, then used a collateral-only LINK deposit to borrow WETH and push the rate further; after interest accrued, the attacker borrowed all XAI liquidity from the market at the manipulated rate.
**Insight:** Direct token donations to a lending pool change totalDeposits without minting shares — check whether interest/utilization math reads raw token balances rather than accounted deposits, and whether a dust deposit plus donation can skew rates enough to borrow cheaply.