# QuantumWN staking: rebase loop inflates sFUMOG balance

QuantumWN staking rebase logic let attacker stake/unstake repeatedly with rebase=true, inflating sFUMOG balance and draining ~0.5 ETH via flash-loaned WETH.

- Payout: Real-world hack
- Severity: medium
- Program: QuantumWN
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/QuantumWN_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230905-quantumwn
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:share-inflation

**Target:** QWAStaking staking contract (stake/unstake with rebase flag)
**Root cause:** unstake with _rebase=true credits sFUMOG based on a rebasing share price that is not correctly decremented, so repeated stake/unstake cycles inflate the attacker's sFUMOG balance relative to deposited FUMOG.
**Steps:**
1. Flash-loan 5 WETH from Balancer vault `0xBA12...F2C8`.
2. Swap WETH->FUMOG on UniswapV2 router `0x7a25...488D`.
3. Approve FUMOG and sFUMOG to QWAStaking `0x6942...a068`.
4. Loop 0x28 times: `stake(address(this), FUMOG.balanceOf(this))` then `unstake(address(this), sFUMOG.balanceOf(this), true)`.
5. Swap accumulated FUMOG back to WETH via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
6. Repay Balancer flash loan plus fee.
**Exploitation:** Attacker flash-loans WETH, buys FUMOG, then repeatedly stakes and unstakes with rebase=true. Each cycle mints sFUMOG without burning equivalent FUMOG, so the attacker's sFUMOG balance grows; unstaking converts the inflated sFUMOG back to FUMOG, which is swapped for WETH and used to repay the flash loan, netting ~0.5 ETH.
**Insight:** When a staking contract exposes a rebase flag on unstake, check whether the share accounting decrements the underlying balance symmetrically; a loop of stake/unstake with rebase=true can compound share inflation even without a price oracle.