# Cellframenet: LP migration calculation flaw drains funds

Cellframenet's LP migration contract miscalculated liquidity during migration, allowing an attacker to repeatedly call migrate() and drain ~$76k via flash-loan-funded swaps.

- Payout: Real-world hack
- Severity: high
- Program: Cellframenet
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/Cellframe_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230601-cellframe
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** LP migration contract (LpMigration) on BSC
**Root cause:** The migrate() function incorrectly calculated the amount of newCELL tokens to mint or liquidity to move during migration, enabling an attacker to repeatedly call it and extract value.
**Steps:**
1. Attacker prepares by swapping WBNB to oldCELL and adding liquidity to the oldCELL/WBNB pair.
2. Take a flash loan of 1000 WBNB from DPPOracle.
3. Inside callback, take a flash loan of 500,000 BUSD from PancakeV3 pool.
4. In pancakeV3FlashCallback, swap newCELL to WBNB, then WBNB to oldCELL to acquire oldCELL.
5. Approve LpMigration to spend CELL9 LP tokens.
6. Call `LpMigration.migrate(lpAmount)` 9 times with lpAmount = CELL9.balanceOf(this)/10.
7. After migrations, transfer PancakeLP tokens to the pool and burn them to redeem underlying assets.
8. Swap remaining WBNB to newCELL and oldCELL to WBNB, then repay the PancakeV3 flash loan.
9. Back in DPPFlashLoanCall, swap newCELL to WBNB and BUSD, then BUSD to WBNB, and repay the DPPOracle flash loan.
**Exploitation:** Attacker used flash loans to manipulate the liquidity migration process, repeatedly calling migrate() to mint excess newCELL or extract value, then swapped and burned LP tokens to drain funds, netting ~$76k.
**Insight:** When a migration function mints or exchanges tokens based on current pool ratios, check if it can be called multiple times in one transaction to compound calculation errors.