# DeltaPrime: claimReward reentrancy drains SmartLoan collateral

DeltaPrime SmartLoan claimReward reentrancy let attacker convert collateral/debt ETH to WETH and claim as reward, draining ~$4.75M via Balancer flash loan.

- Payout: Real-world hack
- Severity: high
- Program: DeltaPrime
- Analysis by: DeFiHackLabs
- Disclosed: 2024-11-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-11/DeltaPrime_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241111-deltaprime
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:flash-loan vuln:reentrancy

**Target:** SmartLoan / SmartLoansFactory lending contract on Arbitrum
**Root cause:** claimReward processes a caller-supplied pair and reward ids without reentrancy protection, allowing a malicious pair contract to reenter and manipulate collateral/debt accounting during reward claiming.
**Steps:**
1. Flash loan all WETH from Balancer vault
2. Withdraw WETH to ETH and deposit as collateral into a freshly created SmartLoan
3. Call `swapDebtParaSwap` with crafted SimpleSwap calldata to borrow ETH against the collateral
4. Call `claimReward(fakePairContract, [0])` where fakePairContract reenters during reward processing
5. Reentrancy converts collateral and debt ETH into WETH and claims it as reward
6. Repay Balancer flash loan, keep profit
**Exploitation:** Attacker flash-borrows WETH from Balancer, converts to ETH, deposits as collateral in a new SmartLoan, borrows ETH via swapDebtParaSwap, then triggers claimReward on a malicious fake pair contract that reenters to convert collateral/debt to WETH and claim it as reward, repaying the flash loan and keeping the remainder.
**Insight:** Reward-claiming functions that accept caller-controlled pair/token addresses are prime reentrancy surfaces: a fake pair can reenter mid-claim to manipulate collateral and debt accounting before solvency checks settle.