# MIC: repeated LP fee claims via swapManual drain funds

MIC token's swapManual() distributed LP fees proportionally to LP token balance, allowing attacker to repeatedly claim fees via new helper contracts and drain ~$500K.

- Payout: Real-world hack
- Severity: high
- Program: MIC
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-02
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/MIC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240102-mic
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic vuln:reward-distribution

**Target:** MIC token contract on BSC
**Root cause:** swapManual() distributes accumulated LP fees to current LP token holders without tracking or limiting claims, allowing repeated claims by transferring LP tokens to new addresses.
**Steps:**
1. Flash loan 1700 BUSDT from BUSDT_USDC pair.
2. Swap half BUSDT to MIC, half to BNB.
3. Add liquidity to MIC/WBNB pair to obtain LP tokens.
4. Call MIC.swapManual() to claim LP fees in BUSDT.
5. Transfer LP tokens to a new LPFeeClaimer contract, call claim() to get fees again.
6. Repeat with new LPFeeClaimer contracts up to 10 times.
7. Remove liquidity, swap MIC to BNB, swap BNB to BUSDT, repay flash loan.
**Exploitation:** Attacker flash-loaned BUSDT, provided liquidity to MIC/WBNB pair, then repeatedly called swapManual() via helper contracts to claim LP fees multiple times, draining ~$500K.
**Escalation:** Repeated the claim cycle 10 times using new helper contracts to amplify profit.
**Insight:** Look for fee distribution functions that can be called repeatedly without tracking claims or limiting frequency; transferring LP tokens to new addresses can bypass per-address limits.