# MahaLend: donation inflation and rounding error drains funds

MahaLend's mUSDC exchange rate was inflated via donation and flash-loan fees, then rounding errors minted shares cheaply, draining ~$20K.

- Payout: Real-world hack
- Severity: high
- Program: MahaLend
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-11
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/MahaLend_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231111-mahalend
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:accounting-error vuln:flash-loan vuln:share-inflation

**Target:** MahaLend lending pool (mUSDC/mARTH)
**Root cause:** Exchange rate manipulation via direct donation to mUSDC inflated share price; repeated flash loans accrued fees to manipulate liquidity index; rounding error in supply allowed minting 1 share for less than its value.
**Steps:**
1. Flash loan USDC from Balancer.
2. Supply small USDC to MahaLend, then flash loan USDC from MahaLend.
3. In executeOperation: transfer USDC directly to mUSDC (donation) to inflate exchange rate, then withdraw depositAmount-1 to leave totalSupply=1.
4. Repeat MahaLend flash loans 54 times to accrue fees and manipulate liquidity index.
5. Borrow all ARTH from mARTH.
6. Loop: supply supplyAmount (≈ half of nextLiquidityIndex) to mint 1 share via rounding, until USDC balance of mUSDC depleted.
7. Withdraw all USDC from mUSDC, repay Balancer flash loan, keep profit.
**How found:** Likely identified that direct token transfers to mUSDC (donation) affect exchange rate, and that rounding in supply could be exploited after manipulating totalSupply and liquidity index via flash loans.
**Exploitation:** Attacker used Balancer flash loan to fund the attack, donated USDC to mUSDC to inflate exchange rate, then used repeated MahaLend flash loans to accrue fees and manipulate the liquidity index. A rounding error in supply allowed minting shares for less than their value, enabling withdrawal of all donated and pool funds.
**Insight:** In lending pools using rebasing or interest-bearing tokens, direct donations can inflate exchange rates; combined with rounding in share minting, an attacker can mint shares cheaply. Check for donation vulnerability and rounding direction in supply/withdraw functions.