# HopeLend: division precision loss drains lending pool reserves

HopeLend's liquidity index suffered division precision loss after donation attack, letting attacker borrow entire pool reserves for ~$825K.

- Payout: Real-world hack
- Severity: critical
- Program: Hopelend
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-18
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/Hopelend_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231018-hopelend
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:precision-loss vuln:share-inflation

**Target:** Lending pool contract (Aave-fork) liquidity index accounting
**Root cause:** The pool's liquidity index calculation loses precision when totalSupply is manipulated down to 1 via a donation + near-full withdraw, causing the index to be inflated and allowing oversized borrows against minimal collateral.
**Steps:**
1. Flash loan 2300 WBTC from Aave V3
2. `HopeLend.deposit(WBTC, 2000e8, attacker, 0)` to get hEthWBTC shares
3. Donate 2000 WBTC directly to hEthWBTC token contract to inflate index
4. `HopeLend.withdraw(WBTC, 2000e8 - 1, attacker)` leaving totalSupply = 1
5. Loop 60x `HopeLend.flashLoan(WBTC, 2000e8, ...)` to further inflate liquidity index via flashloan premiums
6. Borrow entire balances of WETH, USDT, USDC, HOPE, stHOPE hToken reserves
7. Swap stHOPE->HOPE->USDT via Uniswap V2, USDT->USDC->WBTC via Uniswap V3
8. Repay Aave flash loan, convert WBTC->WETH, withdraw ETH
**How found:** Likely spotted that the liquidity index divides by totalSupply and that a donation followed by a withdraw of amount-1 leaves totalSupply=1, making the index explode; flashloan premiums further inflate it.
**Exploitation:** Attacker flash-borrowed 2300 WBTC, deposited 2000 WBTC into HopeLend, then donated 2000 WBTC directly to the hEthWBTC token to inflate the liquidity index, and withdrew all but 1 wei of shares to collapse totalSupply to 1. Repeated self-flashloans (60x) further inflated the index via premium accrual. With the inflated index, the attacker borrowed the full reserves of WETH, USDT, USDC, HOPE, and stHOPE hTokens, swapped them to WBTC via Uniswap, repaid the Aave loan, and netted ~$825K.
**Escalation:** Chained donation + near-full withdraw to collapse totalSupply, then 60 self-flashloans to compound index inflation, then borrowed all pool reserves across five assets.
**Insight:** In Aave-fork lending pools, check whether the liquidity index can be manipulated by collapsing totalSupply to 1 via donation + withdraw(amount-1); flashloan premiums accruing to the index amplify the effect.