# MetaLend: CompoundV2 inflation attack drains WBTC via donation

MetaLend's CompoundV2 fork was drained of ~$4K via a first-depositor inflation attack using selfdestruct donation to manipulate exchange rate.

- Payout: Real-world hack
- Severity: high
- Program: MetaLend
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-25
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/MetaLend_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231125-metalend
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** CompoundV2 fork lending pool (mETH/mWBTC)
**Root cause:** Exchange rate between mETH and ETH is based on total assets / total supply; first depositor can inflate it by donating ETH directly to the contract, causing later borrowers to receive fewer shares.
**Steps:**
1. Flash loan 100 WETH from Spark.
2. Withdraw WETH to ETH, deploy Helper with 100 ETH.
3. Helper mints 1 ETH worth of mETH, then redeems totalSupply-2 shares leaving 1 wei share.
4. Deploy Donator, selfdestruct to send ETH to mETH contract, inflating exchange rate.
5. Enter market with mETH, borrow all WBTC cash minus 1 wei.
6. Transfer WBTC to attacker, redeem remaining mETH for ETH, return ETH to attacker.
7. Swap WBTC to WETH, repay flash loan.
**How found:** Likely identified the classic CompoundV2 first-depositor inflation vulnerability in MetaLend's fork, where direct ETH transfers (via selfdestruct) can manipulate the exchange rate.
**Exploitation:** Attacker flash loans WETH, converts to ETH, mints minimal mETH shares, then donates ETH via selfdestruct to inflate mETH price. This allows borrowing a large amount of WBTC against the inflated mETH collateral, which is then swapped and flash loan repaid, netting ~$4K profit.
**Insight:** When auditing CompoundV2 forks, check if the exchange rate can be manipulated by direct token transfers (donations) before any borrows; first depositor can inflate share price to borrow excessive funds.