# Raft fi: index inflation and rounding error drains $3.2M

Raft fi's rcbETH-c index was inflated via cbETH donation plus a rounding-error mint loop, letting the attacker borrow and drain ~$3.2M.

- Payout: Real-world hack
- Severity: critical
- Program: Raft_fi
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-10
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/Raft_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231110-raft
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation vuln:precision-loss vuln:share-inflation

**Target:** PRM (PositionManager) collateral/debt index accounting on Ethereum
**Root cause:** The collateral index (currentIndex) is derived from the contract's cbETH balance, so a direct donation inflates it; managePosition also rounds 1 wei collateral up to 1 wei rcbETH-c, letting an attacker mint collateral for free.
**Steps:**
1. Flash loan 6000 cbETH from Aave V3.
2. Transfer cbETH directly to PRM to donate, then call `PRM.liquidate(liquidablePosition)` to trigger setIndex and inflate rcbETH-c currentIndex.
3. Loop `PRM.managePosition(cbETH, address(this), 1, true, 0, true, 1e18, sig)` ~60+ times, each minting 1 wei rcbETH-c from 1 wei cbETH via rounding.
4. Withdraw the donated cbETH via `managePosition(..., collateralChange, false, ...)`.
5. Borrow R against inflated collateral: `debtChange = collateralAmount * price * 100/130 - existingDebt`.
6. Swap R->USDC on Uniswap V3, USDC->WETH, unwrap, swap ETH->cbETH on Curve, repay Aave.
**How found:** Likely spotted that currentIndex is computed from the contract's token balance (donation-inflatable) and that managePosition rounds collateral up, allowing repeated 1-wei mints.
**Exploitation:** Attacker flash-borrowed 6000 cbETH, donated it to PRM to inflate the collateral index, triggered setIndex via liquidate, then exploited the 1-wei rounding in managePosition to mint rcbETH-c collateral cheaply, redeemed the donation, borrowed R against the inflated position, and swapped R through Uniswap V3 and Curve back to cbETH to repay the flash loan, netting ~$3.2M.
**Escalation:** Index inflation amplified the rounding-error mint loop, turning a 1-wei rounding bug into a multi-million-dollar undercollateralized borrow.
**Insight:** When a share/index price is derived from a live token balance, a direct transfer (donation) moves the index; combine that with any round-up in share minting to mint collateral for ~free, then borrow against it.