# WiseLending: share inflation via deposit/withdraw loop drains pool

WiseLending share-price manipulation via repeated deposit/withdraw inflated collateral, letting attacker borrow wstETH against worthless shares and drain ~$464K.

- Payout: Real-world hack
- Severity: high
- Program: WiseLending
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/WiseLending02_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240112-wiselending02
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** WiseLending lending pool (poolToken share accounting)
**Root cause:** Deposit/withdraw share accounting allows pseudoTotalPool to be inflated by depositing pseudoTotalPool*2-1 then withdrawing, repeatedly, without proper health-factor recheck, so a new position can borrow against inflated collateral.
**Steps:**
1. Fork mainnet at block 18983652; deal 1 ether pendleLPT to attacker.
2. Approve and deposit 1 ether pendleLPT into poolToken via `depositExactAmount(1 ether)`.
3. Mint NFT position via `nft.mintPosition()`.
4. Deposit 1e9 poolToken into WiseLending for nftId; transfer 1e9 poolToken directly to WiseLending.
5. Read `lendingPoolData(poolToken)`; skip 5 seconds; withdraw all shares via `withdrawExactShares(nftId, poolToken, share)`.
6. Loop 20x: read pseudoTotalPool; `depositExactAmount(nftId, poolToken, pseudoTotalPool*2-1)`; `withdrawExactAmount(nftId, poolToken, share)`.
7. Final deposit `pseudoTotalPool*2-1` to inflate share price.
8. Transfer inflated poolToken balance to second account; mint new NFT; deposit all poolToken.
9. Call `IWiseSecurity.maximumBorrowToken(nftId, poolToken, 0)` and `borrowExactAmount(nftId, wsteth, amount)` to drain wstETH.
**How found:** Likely spotted that `depositExactAmount` with `pseudoTotalPool*2-1` followed by `withdrawExactAmount` changes share accounting without a health-factor recheck, enabling share-price inflation.
**Exploitation:** Attacker flash-funded or seeded a small pendleLPT position, then used a deposit/withdraw loop to inflate the poolToken share price. A fresh position deposited the inflated poolToken as collateral, and the bad health-factor check allowed borrowing the maximum wstETH, netting ~$464K.
**Escalation:** Repeated loop amplified share price; second NFT position isolated the inflated collateral from the manipulation loop.
**Insight:** In lending pools using pseudoTotalPool/totalDepositShares, test whether depositing an amount near 2x pseudoTotalPool then withdrawing can skew share price; check if health factor is recomputed after each deposit/withdraw and whether a fresh position can borrow against manipulated shares.