# WECO staking: deposit logic flaw drains rewards

WECO staking deposit logic flaw allowed attacker to repeatedly deposit 1 wei and drain ~$18K in WECOIN via reward accounting error.

- Payout: Real-world hack
- Severity: high
- Program: WECO
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/WECO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231116-weco
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:accounting-error vuln:business-logic

**Target:** WECOStaking contract on BSC
**Root cause:** Deposit function likely miscalculates rewards or shares when depositing small amounts repeatedly, allowing attacker to extract more than deposited.
**Steps:**
1. Obtain 25,000,001 WECOIN tokens.
2. Approve WECOStaking to spend max uint.
3. Call `deposit(25,000,000 ether, 0)` to stake most tokens.
4. Call `deposit(remaining balance, 0)` to stake the rest.
5. Loop calling `deposit(1 ether, 0)` while contract balance allows, accumulating profit.
**Exploitation:** Attacker staked large amount then repeatedly deposited 1 ether to exploit reward calculation, withdrawing more WECOIN than deposited, netting ~$18K.
**Insight:** Staking contracts that update rewards on every deposit can be vulnerable to repeated small deposits if reward calculation is not properly checkpointed; test deposit/withdraw sequences with varying amounts.