# MIMSpell CauldronV4 precision loss drains $6.5M

Precision loss in MIMSpell CauldronV4 repayForAll let attacker inflate borrow accounting and drain ~$6.5M via flash-loan-funded loop.

- Payout: Real-world hack
- Severity: critical
- Program: MIMSpell
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-30
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/MIMSpell2_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240130-mimspell2
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:precision-loss

**Target:** CauldronV4 lending market on DegenBox (MIM)
**Root cause:** repayForAll computes amount from elastic/base borrow totals with rounding, letting attacker craft a repayment that reduces totalBorrow elastic below actual, inflating share value and enabling over-borrow.
**Steps:**
1. Flash loan 300k MIM from DegenBox
2. Compute amount = uint128(elastic + 50e18) - 240_000e18 and deposit as MIM share to DegenBox
3. Transfer 240k MIM to CauldronV4 and call `repayForAll(240_000e18, true)` to skew totalBorrow accounting
4. Repay borrow parts of 15 victim users via `repay(user, true, borrowPart)`
5. Deposit yvCurve_3Crypto_f collateral into CauldronV4
6. Run helper loop borrowing/repaying ~90x to amplify
7. addCollateral + borrow full MIM balance of CauldronV4, withdraw, repay flash loan
**Exploitation:** Attacker flash-borrows MIM, manipulates CauldronV4 totalBorrow via repayForAll precision rounding, repays victim positions, deposits Curve 3Crypto collateral, then loops borrow/repay 90x to extract MIM from the cauldron and swaps to USDT/USDC/WETH.
**Escalation:** 90x borrow/repay loop amplifies the accounting skew into ~$6.5M extraction.
**Insight:** In BentoBox-style Cauldron accounting, audit repayForAll and totalBorrow elastic/base rounding: small rounding deltas in aggregate repay paths can be amplified by looping borrow/repay against the same cauldron.