# Mosca: join/exit logic flaw drains USDC via flash loan

Mosca's join/exitProgram logic flaw let an attacker flash-loan USDC, buy MOSCA, and repeatedly join/exit to drain ~19K USDC.

- Payout: Real-world hack
- Severity: high
- Program: Mosca
- Credited: DeFiHackLabs
- Disclosed: 2025-01-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/Mosca_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250106-mosca
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** Mosca staking contract on BSC
**Root cause:** The join and exitProgram functions likely miscalculate rewards or refunds, allowing repeated join/exit cycles to extract value from the contract.
**Steps:**
1. Flash loan 1000 USDC from PancakeV3Pool.
2. Call `buy(amount, true, 2)` to acquire MOSCA tokens.
3. Call `exitProgram()` to exit the program.
4. Loop 20 times: call `join(30e18, 0, 2, false)` then `exitProgram()`.
5. Repay flash loan and keep profit.
**Exploitation:** Attacker flash-loaned USDC, bought MOSCA, then repeatedly joined and exited the program to exploit a logic flaw, draining ~19K USDC from the contract.
**Insight:** Look for join/exit or stake/unstake functions where the accounting between deposit and withdrawal can be manipulated by repeated cycles, especially when combined with a flash loan to amplify capital.