# NCD: business logic flaw enables repeated reward claims

NCD token reward logic allowed repeated reward claims via multiple contracts, draining $6.4K from the NCD/USDC pair.

- Payout: Real-world hack
- Severity: high
- Program: NCD
- Credited: DeFiHackLabs
- Disclosed: 2024-06-04
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/NCD_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240604-ncd
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:reward-distribution

**Target:** NCD token reward mechanism and Uniswap V2 pair
**Root cause:** The reward distribution logic incorrectly allowed multiple contracts to claim rewards for the same mining period, and the 'ack' function could be called repeatedly to extract rewards.
**Steps:**
1. Attacker obtains 10 USDC and swaps for NCD via Uniswap V2 router.
2. Transfers 5% of NCD balance to the NCD/USDC pair to manipulate price or liquidity.
3. Deploys 100 instances of `LetTheContractHaveRewards` contract, each calling `preStartTimeRewards()` to skim pair and set start time.
4. Waits 1 day (vm.warp).
5. Obtains 10,000 USDC (flash loan or deal) and swaps for NCD.
6. For each reward contract, transfers NCD and calls `ack()` to claim rewards, doubling NCD balance each time.
7. Repeatedly deploys `LetTheContractHaveUsdc` contracts, transfers NCD, and calls `withdraw()` to swap NCD for USDC.
8. Repays 10,030 USDC and keeps profit.
**Exploitation:** Attacker used multiple contracts to repeatedly claim NCD rewards, then swapped inflated NCD for USDC, draining the pair.
**Escalation:** Scaled by deploying 100 reward contracts and looping withdrawals until NCD balance depleted.
**Insight:** Reward mechanisms that allow multiple contracts to claim for the same period can be exploited by deploying many contracts and triggering claims repeatedly.