# PeapodsFinance: flash callback reentrancy drains DAI via bond/debond

PeapodsFinance flash-loan callback reentrancy let attacker repeatedly bond/debond Peas to inflate share value and drain ~1K DAI.

- Payout: Real-world hack
- Severity: medium
- Program: PeapodsFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-29
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/PeapodsFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240129-peapodsfinance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:reentrancy vuln:share-inflation

**Target:** ppPP bond/debond flash-loan contract on Ethereum
**Root cause:** The flash() callback executes before state is settled, and the callback can call bond()/debond() reentrantly, letting the attacker manipulate the Peas/DAI accounting within a single flash cycle.
**Steps:**
1. Fork mainnet at block 19109652, fund attacker with 200 DAI.
2. Loop 20 times: `DAI.approve(ppPP, 10e18)` then `ppPP.flash(this, Peas, Peas.balanceOf(ppPP), "")`.
3. In `callback`, approve and `ppPP.bond(Peas, Peas.balanceOf(this))` to re-enter bonding during the flash.
4. After loop, `ppPP.debond(ppPP.balanceOf(this), [Peas], [100])` to redeem inflated shares.
5. Swap Peas to WETH via Uniswap V3 `exactInput` path Peas->DAI->WETH.
**Exploitation:** Attacker uses ppPP.flash to borrow all Peas, re-enters bond() in the callback to mint shares at manipulated value, repeats 20x to compound share inflation, then debonds for profit and swaps Peas to WETH.
**Escalation:** Repeated flash cycles (20 iterations) compound the accounting error, amplifying a small per-cycle gain into ~1K DAI.
**Insight:** When a protocol exposes a flash() with an arbitrary callback, check whether bond/debond/mint/redeem functions are callable from inside that callback before the flash state is reconciled — reentrancy into share accounting is the classic amplifier.