# SNK Minter: reward calc uses all children balances

SNK Minter rewardPerToken multiplied by all children's balances, letting an attacker bind child accounts to inflate rewards and drain ~$197k.

- Payout: Real-world hack
- Severity: high
- Program: SNK
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/SNK_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230510-snk
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:flash-loan vuln:reward-distribution

**Target:** SNK Minter staking/reward contract on BSC
**Root cause:** Reward calculation uses the parent's rewardPerToken but multiplies it by the sum of all children's balances, so a parent with many bound children accrues rewards far exceeding its own stake.
**Steps:**
1. Fork BSC at block 27784455; deal 1000 SNK to attacker.
2. Create 10 HackerTemplate contracts, each staking 100 SNK, and register them as parents.
3. Warp 20 days to accrue rewards.
4. Flash-swap 80,000 SNK from the Pancake pair via `pool.swap(80_000 ether, 0, address(this), bytes("0x123"))`.
5. In pancakeCall, for each parent: deploy a new child, `bindParent(parent)`, transfer all SNK to child, `stake()`, then parent `exit()` and child `exit()` to harvest inflated rewards.
6. Repay 85,000 SNK to the pool and swap harvested SNK to BUSD.
**How found:** Reviewer noticed the reward formula uses parent rewardPerToken but multiplies by all children's balances, an accounting mismatch exploitable by binding many children.
**Exploitation:** Attacker flash-borrows SNK from the Pancake pair, binds fresh child stakers under pre-seeded parent accounts, and triggers exit so the parent's rewardPerToken is multiplied by the aggregate child balance, minting excess SNK rewards that are swapped to BUSD for ~$197k profit.
**Escalation:** Repeated bind/stake/exit across 10 parents inside one flash-loan callback amplifies the reward miscalculation.
**Insight:** In staking/reward contracts, check whether per-account reward indices are multiplied by aggregate child balances rather than the caller's own stake; binding many sub-accounts can inflate payouts.