# Burntbubba farming LP token price manipulation drains ~$3K

Burntbubba farming contract's LP share accounting was manipulated via flash-loaned liquidity and emergencyWithdraw, netting ~$3K from the pool.

- Payout: Real-world hack
- Severity: medium
- Program: Burntbubba
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-29
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/Burntbubba_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231129-burntbubba
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** FarmingLPToken deposit/emergencyWithdraw share accounting on Ethereum
**Root cause:** FarmingLPToken computes withdrawable value from spot LP balances/shares that an attacker can inflate by depositing flash-loaned liquidity, so emergencyWithdraw pays out more than the attacker's fair share.
**Steps:**
1. Flash loan 800e6 USDC + 50e16 WETH from Balancer
2. Inside callback, flash loan 400,000 SUSHI from SushiSwap
3. Add liquidity USDC/WETH, USDC/AST, SUSHI/AST on SushiRouter to seed pools
4. Call `FarmingLPToken.deposit(SushiUSDC.balanceOf(this), path0, path1, 0, this, deadline)` with manipulated LP balance
5. Compute transferAmount = balanceOf(this) - (value*totalShares/withdrawableTotalLPs) and `FarmingLPToken.transfer(toAddr, transferAmount)`
6. Call `FarmingLPToken.emergencyWithdraw(this)` to pull inflated value
7. Burn SushiUSDC and AST_SUSHI LP tokens to redeem underlying
8. Swap WETH->SUSHI via SushiRouter to repay Sushi flash loan + fee
9. Repay Balancer flash loan
**Exploitation:** Attacker flash-borrows USDC/WETH from Balancer and SUSHI from SushiSwap, mints LP tokens across Sushi pools to distort the FarmingLPToken's share-to-LP valuation, deposits into the farm, then calls emergencyWithdraw to redeem more underlying than deposited, repaying loans and keeping the delta (~$3K).
**Insight:** Farm contracts that price LP shares from live pool balances are manipulable: check whether deposit/withdraw math reads spot reserves or totalShares that a flash loan can inflate within one tx, and whether emergencyWithdraw bypasses normal accounting.