# Midas Capital: precision-loss collateral inflation drains lending pools

Precision loss in Midas Capital's fsAMM_HAY_BUSD fToken let attacker inflate collateral via 1001-wei redeem, borrow all fankrBNB/fHAY, drain ~$600K.

- Payout: Real-world hack
- Severity: high
- Program: MidasCapitalXYZ
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-17
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/MidasCapitalXYZ_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230617-midascapitalxyz
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation vuln:precision-loss

**Target:** Compound-fork lending market fToken (fsAMM_HAY_BUSD) on BSC
**Root cause:** fsAMM_HAY_BUSD redeem/mint accounting loses precision on tiny amounts, so redeeming balance-1001 leaves a 1001-wei fToken position that still counts as collateral while the underlying was withdrawn.
**Steps:**
1. Flash-borrow ANKR from ankrBNB_ANKRV2 (pancakeCall) and ankrBNB_ANKRV3 (algebraFlashCallback).
2. Mint HAY/BUSDT LP via `transferTokensAndMintLiqudity(20_000e18)`, `fsAMM_HAY_BUSD.mint(liquidityMinted)`.
3. `fsAMM_HAY_BUSD.redeem(fsAMM_HAY_BUSD.balanceOf(address(this)) - 1001)` leaving 1001 wei fToken.
4. Deposit HAY/BUSDT into HAY_BUSDT_Vault to fsAMM_HAY_BUSD, transfer 1001 fToken to Borrower.
5. Borrower: `fANKR.mint(ANKR.balanceOf)`, `Unitroller.enterMarkets([fANKR, fsAMM_HAY_BUSD])`, then `fankrBNB.borrow(fankrBNB.getCash())` and `fHAY.borrow(borrowAmount)`.
6. Swap ankrBNB->WBNB->BUSDT via algebra/pancakeV3 to realize value, repay flash loans.
**Exploitation:** Attacker flash-loaned ANKR, minted LP, exploited the 1001-wei redeem precision loss to keep a nominal fToken collateral position while withdrawing underlying, then used it as collateral to borrow out all fankrBNB and fHAY cash, swapped to stable and repaid flash loans keeping ~$600K.
**Escalation:** Chained two flash-loan sources (Pancake V2 + Algebra V3) plus oracle-priced LP collateral to borrow entire market cash in one tx.
**Insight:** On Compound forks, test redeem/mint with balance-1 or balance-1001 amounts: rounding in fToken exchange-rate math can leave collateral credited after underlying is withdrawn, letting you borrow against phantom collateral.