# INcufi: referral reward abuse drains staking contract

INcufi staking contract allowed repeated stake/withdraw with referral rewards, draining ~59K USD via 100 iterations and swapCommision.

- Payout: Real-world hack
- Severity: high
- Program: INcufi
- Credited: DeFiHackLabs
- Disclosed: 2024-06-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/INcufi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240618-incufi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:reward-distribution

**Target:** BSC staking contract
**Root cause:** The staking contract's referral reward logic and withdrawal mechanism allowed an attacker to repeatedly stake and withdraw, collecting referral rewards and principal without proper accounting.
**Steps:**
1. Deploy `Money` contract via CREATE2, which registers a referer and creates a `Moneys` contract.
2. Call `Ncufi.register(Two_referer)` with the computed address of `Moneys`.
3. Approve BUSD to Ncufi and loop 100 times: `Ncufi.STAKE(10_000 ether, 0, 1)`, warp time +100s, fetch order id via `listMyoID()`, call `Ncufi.withdral(id)`.
4. After each withdrawal, transfer AKITADEF tokens from `One_referer` and `Two_referer` to the attacker.
5. Finally, approve AKITADEF and call `Ncufi.swapCommision(59_643.218325 ether)` to convert accumulated tokens to BUSD.
**Exploitation:** Attacker deployed helper contracts to register referrals, then repeatedly staked 10,000 BUSD with 0-day period, withdrew after 100 seconds, and collected referral rewards in AKITADEF tokens. After 100 iterations, swapped accumulated AKITADEF for ~59K USD via swapCommision.
**Insight:** Staking contracts with referral bonuses and short lock periods can be abused by cycling stake/withdraw to farm referral rewards; check if withdrawal resets reward eligibility or if referral rewards are paid per stake regardless of duration.