# LPMine: reward calculation flaw enables repeated claims

LPMine reward calculation used pair balance and failed to update time, allowing repeated reward claims via flash loan for ~24k USDT.

- Payout: Real-world hack
- Severity: high
- Program: LPMine
- Credited: DeFiHackLabs
- Disclosed: 2025-01-08
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/LPMine_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250108-lpmine
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:accounting-error vuln:reward-distribution

**Target:** LPMine staking contract on BSC
**Root cause:** Reward calculation used the pair's balance and did not correctly update the last claim time, allowing multiple claims within the same block or without proper time decay.
**Steps:**
1. Flash loan 1000 USDT from DODO.
2. Swap half USDT to ZF tokens.
3. Approve ZF and USDT to LPMine.
4. Call `partakeAddLp(2, ZF.balanceOf(this), 500 ether, 0x114FAA...)` to add liquidity.
5. Warp time by 2 hours.
6. Flash loan 5,000,000 USDT from PancakeSwap V3 pool.
7. In callback, transfer USDT to pair, then loop 2000 times calling `LPMine.extractReward(1)`.
8. Transfer 1 ZF to pair, call `pair.skim(this)` to recover excess tokens.
9. Swap ZF and WTO to USDT, repay flash loans.
**How found:** Likely identified that reward calculation relied on pair balance and did not update time correctly, enabling multiple claims.
**Exploitation:** Attacker used flash loans to add liquidity, then repeatedly called extractReward in a loop to drain rewards due to incorrect time update and balance-based calculation, profiting ~24k USDT.
**Insight:** When reward logic uses current pair balance and fails to update last claim timestamp, test repeated claims within the same block or after minimal time.