# Barley Finance wBARL pod reentrancy drains BARL supply

wBARL pod's flash/bond/debond flow was reentrancy-abused to mint pod shares from flash-loaned BARL, stealing ~10% of BARL supply (~$130K).

- Payout: Real-world hack
- Severity: high
- Program: BarleyFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/BarleyFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240128-barleyfinance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation vuln:reentrancy vuln:share-inflation

**Target:** wBARL pod contract (ERC-4626-like bond/debond vault) on Ethereum mainnet
**Root cause:** wBARL.flash() invokes an attacker-controlled callback before accounting settles, and bond()/debond() share pricing can be manipulated within that callback window, letting the attacker mint shares against flash-borrowed BARL.
**Steps:**
1. Fork mainnet at block 19106654; fund attack contract with 200 DAI.
2. Loop 20 times: `DAI.approve(wBARL, 10e18)` then `wBARL.flash(address(this), BARL, BARL.balanceOf(wBARL), "")`.
3. In `callback()`: `BARL.approve(wBARL, balance)` then `wBARL.bond(BARL, BARL.balanceOf(this))` — reentering bond during flash accounting.
4. After loop: `wBARL.debond(wBARL.balanceOf(this), [BARL], [100])` to redeem inflated shares for BARL.
5. Swap BARL→DAI→WETH via Uniswap V3 `exactInput` with path `BARL/0x002710/DAI/0x0001f4/WETH`.
6. Repeat flash/bond cycle to compound share inflation; net ~$130K WETH.
**Exploitation:** Attacker flash-borrows BARL from wBARL, reenters bond() in the flash callback to mint pod shares at manipulated pricing, then debonds to redeem more BARL than deposited, converting to WETH via Uniswap V3. Repeated 20x with only 200 DAI seed capital.
**Escalation:** Looping the flash/bond cycle 20 times compounds the share inflation; ~10% of BARL supply (mostly team collateral) extracted.
**Insight:** Vaults exposing a flash() with an external callback that also expose bond()/debond() share-minting are reentrancy-prone: check whether share price is read before the callback returns, and whether bond() can be called mid-flash to mint shares against borrowed tokens.