# LFI Token: repeated reward claims via delegatecall claimer contracts

LFI Token's vLFI staking reward claim logic allowed repeated reward claims via delegatecall-spawned claimer contracts, netting ~36K USD.

- Payout: Real-world hack
- Severity: high
- Program: LFI Token
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/LFI_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230523-lfi
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:reward-distribution

**Target:** vLFI staking/reward contract on Polygon
**Root cause:** The claimRewards function did not properly track or limit reward eligibility per staked position, allowing a staker to repeatedly claim rewards by rotating the 'to' address through delegatecall-created contracts.
**Steps:**
1. Acquire 86,000 LFI tokens.
2. Approve vLFI contract to spend LFI and call `VLFI.stake(address(claimer), LFI.balanceOf(address(this)))` to stake on behalf of a Claimer contract.
3. Loop 200 times: call `claimer.delegate(VLFI.balanceOf(address(claimer)), address(this))`, which delegatecalls `claimReward(uint256,address)` on the Claimer.
4. Inside claimReward: call `VLFI.claimRewards(owner)` to claim rewards, then create a new Claimer, transfer vLFI balance to it, and return its address.
5. Repeat to accumulate rewards; final LFI balance shows profit.
**Exploitation:** Attacker staked LFI to receive vLFI, then used a chain of delegatecall-created Claimer contracts to repeatedly call claimRewards with different 'to' addresses, each time transferring the vLFI balance to a fresh contract to reset claim state, draining ~36K USD in rewards.
**Insight:** Reward-claiming logic that keys eligibility to the caller or a mutable 'to' address can be bypassed by rotating contract addresses via delegatecall; check if claim state is tied to the staked position or to the claiming address.