# ChannelsFinance: CompoundV2 inflation attack drains cCLP market

ChannelsFinance cCLP_BTCB_BUSD CompoundV2 market hit by inflation/donation attack via gulp(), draining ~$320K across two BSC txs.

- Payout: Real-world hack
- Severity: high
- Program: ChannelsFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-30
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/ChannelsFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231230-channelsfinance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** CompoundV2-fork cToken market (cCLP_BTCB_BUSD) on BSC
**Root cause:** cToken exchange rate is computed from underlying balance/totalSupply; attacker donated underlying and used gulp() to inflate the exchange rate, then exploited rounding on mint/redeem and borrowing power.
**Steps:**
1. Fork BSC at block 34806205
2. Attacker pre-funded attack contract with tokens (PancakeSwapToken, etc.)
3. First tx: manipulate totalSupply/exchange rate of cCLP_BTCB_BUSD via donation + gulp() to inflate borrowing power
4. Flash loan 11,900 BTCB from BUSDT_BTCB Uniswap V3 pair
5. Nested flash loan 500,000 BUSD from BUSDT_BUSD pair
6. Repay BTCB flash loan with fee
7. Add liquidity to BTCB_BUSD V2 pair (115% of reserves) and mint LP
8. Transfer PancakeSwapToken and BTCB_BUSD LP tokens into cCLP_BTCB_BUSD, call accrueInterest()
9. Enter markets, mint cTokens at inflated rate, borrow against inflated collateral, redeem/withdraw underlying
**How found:** Attacker recognized the CompoundV2 fork's gulp()/donation surface lets an external actor rewrite the cToken's underlying balance and thus its exchange rate, enabling classic first-depositor/inflation economics against a thinly-seeded market.
**Exploitation:** Two-transaction attack: first tx inflated cCLP_BTCB_BUSD totalSupply/exchange rate via token donation and gulp(); second tx used nested Uniswap V3 flash loans (BTCB then BUSD) to fund LP minting and donation into the vulnerable cToken, then minted cTokens at the manipulated rate to borrow and withdraw more than deposited, netting ~$320K.
**Escalation:** Chained two flash loans across Uniswap V3 pairs plus V2 LP minting to amplify capital and manipulate the cToken exchange rate before borrowing.
**Insight:** On CompoundV2 forks, any public gulp()/skim()/sync() that resyncs underlying balance is a direct exchange-rate manipulation primitive; check whether a market's totalSupply is small enough that a donation can move the cToken price and inflate borrowing power before a flash-loan-funded mint/borrow.