# DualPools precision truncation enables multi-asset collateral drain

Precision truncation in DualPools' liquidateCalculateSeizeTokens let attacker borrow against tiny dLINK collateral and drain ~$42k across multiple assets.

- Payout: Real-world hack
- Severity: high
- Program: DualPools
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-15
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/DualPools_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240215-dualpools
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:precision-loss

**Target:** DualPools lending market (Compound/Venus fork) on BSC
**Root cause:** liquidateCalculateSeizeTokens truncates precision when computing seize tokens, allowing an attacker to mint minimal dLINK collateral (2 wei) and borrow far more than the collateral's value.
**Steps:**
1. Flash loan 7e18 BUSD from DPPOracle_0x1b52.
2. Swap BUSD to LINK on PancakeSwap to obtain LINK tokens.
3. Flash loan WBNB and BUSD from DPPOracle_0x8191 via pancakeCall.
4. Flash loan 70e21 BUSD from Uniswap V3 pool via pancakeV3FlashCallback.
5. Enter Venus markets with vBUSD and vWBNB; mint vBUSD and vWBNB; borrow 11.5e21 LINK from vLINK.
6. Mint 2 wei dLINK, transfer 11.499e21 LINK to dLINK, enter DualPools market with dLINK.
7. Borrow large amounts of dWBNB, dBTCB, dETH, dADA, dBUSD against the 2 wei dLINK collateral.
8. Redeem underlying LINK from dLINK, repay vLINK borrow, redeem vBUSD and vWBNB.
9. Repay flash loans and transfer remaining WBNB/BUSD to attacker.
**Exploitation:** Attacker used nested flash loans to obtain capital, supplied a tiny amount of dLINK (2 wei) as collateral, then borrowed multiple assets from DualPools far exceeding collateral value due to truncation in seize token calculation. Repaid flash loans and kept ~$42k profit.
**Escalation:** Chained multiple flash loans and cross-protocol (Venus, PancakeSwap, Uniswap V3) to amplify capital and drain multiple assets from DualPools.
**Insight:** When auditing Compound/Venus forks, scrutinize liquidation seize token math for truncation or rounding errors that let tiny collateral support large borrows; test with minimal collateral amounts.