# SteamSwap MineSTM logic flaw enables flash-loan drain

SteamSwap's MineSTM contract had a logic flaw in sell/updateAllowance allowing an attacker to flash-loan BUSD, buy STM, and sell repeatedly to drain ~$91k.

- Payout: Real-world hack
- Severity: high
- Program: SteamSwap
- Credited: DeFiHackLabs
- Disclosed: 2024-06-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/SteamSwap_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240606-steamswap
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan

**Target:** MineSTM staking contract on BSC
**Root cause:** The sell function likely miscalculated rewards or allowed repeated selling without proper allowance/balance checks, enabling profit from price manipulation via flash loan.
**Steps:**
1. Flash loan 500k BUSD from PancakeV3Pool.
2. Approve PancakeRouter and swap all BUSD for STM.
3. Call MineSTM.updateAllowance() to set allowance.
4. Approve MineSTM to spend STM.
5. Call MineSTM.sell() four times with large STM amounts.
6. Repay flash loan with 50k BUSD fee.
**Exploitation:** Attacker flash-loaned 500k BUSD, swapped for STM, then repeatedly called sell on MineSTM to extract BUSD, repaying loan and keeping ~$91k profit.
**Insight:** In staking/reward contracts, check if sell/withdraw functions can be called multiple times in one transaction or if they rely on manipulable spot prices; flash loans can amplify such logic flaws.