# Unilend V2: health factor miscalculation drains stETH pool

Unilend V2 pool miscalculated health factor, letting attacker flash-borrow wstETH, lend/borrow against it, and drain 60 stETH from the pool.

- Payout: Real-world hack
- Severity: critical
- Program: Unilend
- Credited: DeFiHackLabs
- Disclosed: 2025-01-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/Unilend_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250112-unilend
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** UnilendV2Core lending pool (USDC/stETH)
**Root cause:** The pool's health-factor/LTV accounting miscalculated collateral value when lending and borrowing in the same transaction, allowing borrows exceeding the true collateral ratio.
**Steps:**
1. Attacker pledged 200 USDC to UnilendV2Pool and received position NFT #115 with ~150M lendShares.
2. Transfer NFT #115 to attack contract via `safeTransferFrom`.
3. Flash-borrow 60M USDC from Morpho.
4. Inside callback, flash-borrow wstETH equal to `getWstETHByStETH(getAvailableLiquidity1())` from Morpho.
5. Unwrap wstETH to stETH; call `unilendCore.lend(pool, -60M USDC)` and `lend(pool, stAmount)` to manipulate shares.
6. Call `borrow(pool, borrowAmount=stETH balance of pool, 0, attacker)` to borrow entire stETH liquidity.
7. Call `redeemUnderlying` for stETH and USDC to unwind, wrap stETH back to wstETH, repay flash loans, transfer 60 stETH profit to attacker.
**Exploitation:** Attacker used a pre-existing position NFT with inflated lendShares, flash-borrowed USDC and wstETH from Morpho, then abused Unilend's lend/borrow/redeem sequence to borrow the pool's entire stETH balance against manipulated collateral accounting, repaying flash loans and keeping ~60 stETH.
**Escalation:** Chained Morpho flash loans (USDC then wstETH) to supply the capital needed to manipulate pool state within a single transaction.
**Insight:** When a lending pool lets you lend and borrow the same asset pair in one tx, check whether health factor is recomputed between lend and borrow; a stale or share-based LTV can let you borrow the full available liquidity against freshly-minted shares.