# OSN: reward distribution flaw enables repeated LP reward claims

OSN reward distribution contract failed to check LP hold time or receiver contract status, allowing attacker to create many helper contracts and claim rewards repeatedly for ~109K USD profit.

- Payout: Real-world hack
- Severity: high
- Program: OSN
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-06
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/OSN_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240506-osn
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic vuln:reward-distribution

**Target:** BSC reward distribution contract
**Root cause:** Reward distribution contract did not verify LP token hold duration or whether the receiver was a contract, allowing immediate reward claims from multiple addresses.
**Steps:**
1. Flash loan 500,009.458 USDT from PancakeSwap V3 pool `0x46Cf1cF8c69595804ba91dFdd8d6b960c9B0a7C4`.
2. Swap USDT to OSN multiple times to accumulate OSN.
3. Add liquidity to USDT/OSN pair `0x4EEDdCc7C8714A684311F8b01154B5686A0f612f` to obtain LP tokens.
4. Deploy 100 helper contracts via CREATE2, each pre-funded with 0.001 USDT and 0.001 OSN.
5. Transfer LP tokens to each helper contract and call `addLiq(pair_balance)` on each to trigger reward distribution.
6. Remove liquidity from main contract.
7. Perform swaps to activate dividend distribution.
8. Call `cc()` on each helper contract to collect accumulated rewards.
9. Repay flash loan and keep profit.
**How found:** Attacker likely noticed that the reward distribution contract did not enforce a minimum LP holding period or restrict contracts, enabling repeated claims from many addresses.
**Exploitation:** Attacker flash-loaned USDT, swapped to OSN, added liquidity, then used 100 helper contracts to each hold LP tokens briefly and claim rewards. After activating dividends via swaps, each helper contract's `cc()` function added liquidity and transferred USDT rewards to the attacker, netting ~109K USD.
**Escalation:** Used 100 helper contracts to multiply reward claims, amplifying profit from a single flash loan.
**Insight:** When auditing reward distribution contracts, check for missing time-locks or contract-address restrictions that allow sybil-like reward farming with multiple addresses.