# WiseLending: donation share inflation and rounding drain

WiseLending share-price inflation via WBTC donation plus rounding error let attacker borrow all pools and drain ~$260K.

- Payout: Real-world hack
- Severity: high
- Program: WiseLending
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-13
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/WiseLending_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231013-wiselending
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:precision-loss vuln:share-inflation

**Target:** Lending pool share accounting (deposit/withdraw/borrow)
**Root cause:** Share price derived from pseudo total pool is inflatable by direct token donation; withdrawExactAmount rounds share amount down to zero, letting attacker withdraw repeatedly without burning shares.
**Steps:**
1. Flash loan 50 WBTC from Balancer
2. Mint two positions: recoverID and borrowerID
3. Deposit 1 WBTC into each position (1 share each)
4. Transfer ~50 WBTC directly to WiseLending to inflate WBTC share price
5. borrowAll(borrowerID): borrow wstETH, WETH, aEthWETH, DAI, sDAI, aEthDAI, aEthUSDC, aEthUSDT, USDC against inflated collateral
6. recover(): loop `withdrawExactAmount(recoverID, WBTC, (pseudoTotalPool-1)/totalDepositShares)` while pseudoTotalPool > 2_000_000 — share amount rounds to 0
7. Swap WETH to WBTC on Uniswap V3 to repay flash loan
**How found:** Likely spotted that share price is computed from pseudoTotalPool which is directly increasable by token transfer, and that withdrawExactAmount's share math truncates to zero for large pools.
**Exploitation:** Attacker flash-borrows 50 WBTC, opens two positions, deposits 1 WBTC each, then donates ~50 WBTC to the pool to inflate the WBTC share price. The inflated collateral value lets the borrower position borrow nearly every asset in the protocol. The recover position then loops withdrawExactAmount where the computed share amount rounds down to zero, draining the donated WBTC without burning shares. Proceeds swapped to repay the flash loan.
**Escalation:** Inflated collateral across all pools enabled borrowing of nine distinct assets in one transaction, maximizing extracted value.
**Insight:** When a lending pool's share price is derived from a raw token balance (pseudoTotalPool) rather than an internal accounting variable, a direct transfer inflates collateral; combine with any withdraw path where `amount * totalShares / totalPool` truncates to 0 to loop-drain the donation.