# Radiant Capital: rounding flaw in rayDiv drains lending pool

Radiant Capital's Aave-fork lending pool had a rounding flaw in rayDiv; attacker inflated liquidityIndex via repeated flashloans and drained ~$4.5M.

- Payout: Real-world hack
- Severity: critical
- Program: RadiantCapital
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-02
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/RadiantCapital_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240102-radiantcapital
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:precision-loss

**Target:** Aave-fork lending pool (RadiantLendingPool) on Arbitrum
**Root cause:** Precision loss in rayDiv rounding when liquidityIndex is inflated to a huge value; deposit/withdraw share math rounds in attacker's favor, letting them withdraw more than deposited.
**Steps:**
1. Flashloan 3M USDC from Aave V3.
2. Deposit 2M USDC into RadiantLendingPool to get rUSDCn shares.
3. Loop 151 times: flashloan 2M USDC from Radiant itself to inflate liquidityIndex.
4. Borrow small WETH amount to leave pool in target state.
5. Deploy HelperExploit; transfer rUSDCn balance and call siphonFundsFromPool.
6. Helper loops deposit(amount<<1)/deposit(amount) then withdraw((amount*3)>>1)-1 or full pool balance, draining USDC from rUSDCn.
7. Swap drained USDC/WETH via Uniswap V3 to repay Aave flashloan and keep profit.
**How found:** Researcher (per Neptune Mutual/Beosin analysis) identified that rayDiv rounding in Aave-fork share math becomes exploitable when liquidityIndex is artificially inflated; crafted recursive flashloan loop to reach that state.
**Exploitation:** Attacker flashloans 3M USDC from Aave, deposits 2M into Radiant, then recursively flashloans from Radiant 151 times to push liquidityIndex to an extreme value. With inflated index, rayDiv rounding in deposit/withdraw share accounting lets the helper contract repeatedly deposit and withdraw slightly more than deposited, siphoning the pool's USDC. Drained funds swapped to WETH via Uniswap V3 to repay Aave and realize ~$4.5M profit.
**Escalation:** Recursive self-flashloans (151 iterations) amplify liquidityIndex inflation, turning a tiny rounding error into full pool drain.
**Insight:** In Aave forks, audit rayDiv/rayMul rounding under extreme liquidityIndex values; recursive self-flashloans can inflate index cheaply, so test deposit/withdraw round-trips at pathological index magnitudes.