# kTAF: CompoundV2 inflation attack drains market via donation

CompoundV2-style kTAF market drained ~$8K via inflation attack: attacker minted tiny kTAF, redeemed leaving 2 wei, then donated TAF to inflate exchange rate and liquidated a borrower for cheap collateral.

- Payout: Real-world hack
- Severity: high
- Program: kTAF
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/kTAF_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231019-ktaf
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:liquidation vuln:share-inflation

**Target:** CompoundV2-fork cToken market (kTAF) on Ethereum
**Root cause:** kTAF's exchange rate is computed from underlying balance divided by total supply; when total supply is tiny (2 wei), a direct TAF donation to the cToken massively inflates the exchange rate, so liquidators seizing kTAF collateral receive far more underlying value per repaid DAI than fair.
**Steps:**
1. Flash-loan 4000 DAI from Balancer Vault.
2. Approve kDAI; loop liquidating borrower 0x3cF7...a67d on kDAI with kTAF as collateral, sizing repayAmount via `liquidateCalculateSeizeTokens`.
3. When remaining kTAF collateral < seize amount, compute repayAmount = (borrowBalance/10 * kTAF.balanceOf(borrower)) / numCtokenCollateral and liquidate.
4. Deploy ExploitHelper; transfer all seized TAF to it.
5. In helper: `enterMarkets([kTAF])`, transfer 1 TAF to kTAF, mint all TAF, redeem all but 2 wei of kTAF, then transfer remaining TAF directly to kTAF (donation) to inflate exchange rate.
6. Borrow up to 1320 DAI from kDAI against the inflated kTAF collateral, then `redeemUnderlying` to extract TAF, return DAI+TAF to attacker.
7. Repeat: liquidate helper for 1 DAI to seize its kTAF, redeem 1 wei, loop while kDAI has DAI; repay flash loan.
**How found:** Attacker recognized kTAF as a CompoundV2 fork and that exchange rate = underlying/totalSupply is manipulable when supply is near zero; direct token donation to the cToken bypasses mint accounting, so a tiny supply plus large donation inflates collateral value used by the comptroller for borrowing and liquidation pricing.
**Exploitation:** Flash loan provides capital; attacker first liquidates an existing borrower to acquire kTAF collateral cheaply, then uses a helper contract to shrink kTAF total supply to 2 wei and donate TAF directly to the cToken, inflating the exchange rate. The helper then borrows DAI from kDAI against the now-overvalued kTAF collateral and redeems underlying, and the attacker repeatedly liquidates the helper for 1 DAI to seize its kTAF and redeem, draining kDAI's DAI reserves (~$8K).
**Escalation:** Iterative liquidate-redeem loop against the helper amplifies extraction until kDAI's DAI balance is exhausted.
**Insight:** On CompoundV2 forks, check whether the cToken's underlying balance can be increased by direct transfer (donation) while totalSupply is tiny; if so, exchange rate inflates and both borrow limits and liquidation seize calculations become exploitable. Also check whether liquidateCalculateSeizeTokens uses the live (manipulable) exchange rate.