# GoodCompound: price manipulation via flash loan drains COMP

Attacker flash-loaned COMP and WETH, manipulated GoodCompound's interest collection via repeated markets to drain ~250 COMP (~$13K).

- Payout: Real-world hack
- Severity: high
- Program: GoodCompound
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/GoodCompound_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231211-goodcompound
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** GoodCompound staking/fund manager contract
**Root cause:** The collectInterest function in GoodFundManager likely calculates interest based on manipulable token balances or prices, allowing an attacker to inflate rewards by flash-loaning and swapping tokens.
**Steps:**
1. Flash loan 894,410 COMP and 55,693 WETH from Balancer.
2. Withdraw WETH to ETH, mint cETH with 450 wei, enter cETH market.
3. Borrow 14,995 COMP against cETH, then swap 4,200 COMP on SushiSwap to trigger uniswapV2Call.
4. In uniswapV2Call: approve tokens, transfer 7.4 COMP from profit_receiver, swap all COMP to WETH on Uniswap V2.
5. Call claimComp with goodCompoundStaking and cdai market.
6. Call collectInterest on GoodFundManager with array of 5 identical goodCompoundStaking addresses, true flag.
7. Swap WETH back to COMP, repay SushiSwap loan, deposit ETH to WETH, repay Balancer loans.
8. Transfer remaining COMP profit to profit_receiver.
**Exploitation:** Attacker used Balancer flash loan to obtain large COMP and WETH, then manipulated GoodCompound's interest collection by calling collectInterest with duplicate market addresses, likely inflating rewards. Swapped tokens via Uniswap/Sushi to profit from price differences and drained COMP tokens.
**Insight:** When a protocol's reward calculation uses an array of markets, check if duplicate entries can be passed to multiply rewards or manipulate internal accounting.