# Libertify: reentrancy in deposit mints excess shares

Libertify vault on Polygon suffered a reentrancy during deposit via 1inch swap callback, letting attacker mint excess shares and drain ~$452k.

- Payout: Real-world hack
- Severity: high
- Program: Libertify
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/Libertify_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230711-libertify
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:flash-loan vuln:reentrancy

**Target:** LibertiVault deposit function on Polygon
**Root cause:** The vault's deposit function calls an external 1inch router with attacker-controlled calldata before updating share accounting, allowing reentrant deposit calls that manipulate totalSupply and mint excess shares.
**Steps:**
1. Flash loan 5,000,000 USDT from Aave V2 (twice).
2. Approve USDT to Aave and call `LibertiVault.deposit(0.001 ether, address(this), callData)` where callData encodes a 1inch V4 swap with dstReceiver = vault.
3. During the 1inch swap, the router calls back into the attacker's fallback, which re-enters `LibertiVault.deposit` to manipulate totalSupply and mint more shares.
4. After deposit returns, call `LibertiVault.exit()` to redeem inflated shares for USDT.
5. Repay flash loans; swap remaining WETH to USDT if needed.
**Exploitation:** Attacker used Aave flash loans to obtain 5M USDT, deposited a tiny amount into the vault with crafted 1inch swap calldata that triggered a callback to the attacker contract. The callback re-entered deposit, inflating share balance. Then exit() redeemed the inflated shares for a large portion of vault assets, netting ~$452k.
**Insight:** Vaults that accept arbitrary calldata for external swap routers must guard against reentrancy during deposit; check for state updates after external calls and for callbacks into user-controlled contracts.