# HeavensGate: rebase loop inflates sHATE, drains ~8 ETH

HeavensGate HATE staking rebase logic let attacker loop stake/unstake with rebase to inflate sHATE, then dump for ~8 ETH.

- Payout: Real-world hack
- Severity: high
- Program: HeavensGate
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/HeavensGate_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230905-heavensgate
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** HATE staking contract and sHATE rebasing token on Ethereum
**Root cause:** Staking unstake with rebase=true triggers a rebase that mints/inflates sHATE balance relative to staked HATE, so repeated stake/unstake cycles grow the attacker's sHATE without proportional HATE cost.
**Steps:**
1. Flash-swap 90% (or 70%) of HATE from the HATE/ETH Uniswap V2 pair via `swap(flashAmount, 0, address(this), hex"03")`.
2. In `uniswapV2Call`, loop `uint8(data[0])` times: `HATEStaking.stake(address(this), HATE.balanceOf(address(this)))` then `HATEStaking.unstake(address(this), sHATE.balanceOf(address(this)), true)` to trigger rebase each iteration.
3. Repay the pair with `HATE.transfer(pair, amount0*1000/997 + 1)`.
4. Swap inflated HATE for WETH via `swapExactTokensForTokensSupportingFeeOnTransferTokens` on Uniswap V2 router.
**How found:** DeFiHackLabs reproduced the on-chain attack; analysis (Hexagate) attributed it to rebasing logic in the staking/unstake flow.
**Exploitation:** Attacker flash-borrows most of the HATE liquidity, repeatedly stakes and unstakes with rebase enabled to inflate sHATE/HATE holdings, repays the flash loan, then sells the inflated HATE into the HATE/ETH pool for ~8 ETH profit.
**Insight:** When a staking contract exposes an unstake flag that triggers rebase, check whether stake/unstake cycles can be looped within one tx to compound rebase minting against a flash-borrowed balance.