# JumpFarm: rebase logic flaw in stake/unstake drains funds

JumpFarm staking rebase logic let attacker repeatedly stake/unstake with rebase=true, inflating sJump and draining ~$2.4 ETH via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: JumpFarm
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/JumpFarm_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230905-jumpfarm
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** Staking contract (stake/unstake with rebase flag)
**Root cause:** The unstake function with _rebase=true recalculates the sJump balance against the underlying jump balance, so repeated stake/unstake cycles inflate the attacker's sJump holdings relative to deposited jump.
**Steps:**
1. Flash loan 15 WETH from Balancer
2. Swap WETH for jump on UniswapV2
3. Approve jump and sJump to staking contract
4. Loop 40 times: `staking.stake(address(this), jump.balanceOf(this))` then `staking.unstake(address(this), sJump.balanceOf(this), true)`
5. Swap accumulated jump back to WETH
6. Repay Balancer flash loan, keep profit
**How found:** Likely spotted that unstake's rebase=true path recomputes share value from current contract balances, making repeated stake/unstake cycles profitable.
**Exploitation:** Attacker flash-borrowed 15 WETH, bought jump, then looped stake/unstake with rebase=true 40 times to inflate sJump balance, sold inflated jump for WETH, repaid loan, netting ~$2.4 ETH.
**Insight:** When a staking contract exposes a rebase flag on unstake, check whether repeated stake/unstake cycles can inflate share balance against the underlying token balance.