# Mosca2: join/withdrawFiat logic flaw drains funds

Mosca2 join/withdrawFiat logic flaw let attacker flash-loan 7000 BUSD, join 7 times, and withdraw inflated amounts for 37.6K profit.

- Payout: Real-world hack
- Severity: high
- Program: Mosca2
- Credited: DeFiHackLabs
- Disclosed: 2025-01-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/Mosca2_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250113-mosca2
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high vuln:accounting-error vuln:business-logic

**Target:** Mosca2 staking contract on BSC
**Root cause:** join() and withdrawFiat() have a logic flaw allowing repeated joins and inflated withdrawals, likely due to incorrect accounting of deposited amounts or fiat conversion.
**Steps:**
1. Flash loan 7000 BUSD from DODO DPP.
2. Approve Mosca to spend BUSD and USDC.
3. Call `join(1e21, 0, 1, false)` 7 times.
4. Call `withdrawFiat(18671180855284200248407, false, 1)`.
5. Call `withdrawFiat(26648013000000000000000, false, 0)`.
6. Repay flash loan and keep profit.
**Exploitation:** Attacker flash-loaned 7000 BUSD, joined Mosca 7 times with 1000 BUSD each, then withdrew 18,671 and 26,648 BUSD (likely USDC) via withdrawFiat, netting ~37.6K profit after repaying the loan.
**Insight:** Look for staking contracts where join and withdraw functions have mismatched accounting or allow repeated joins without proper state updates, especially when fiat conversion is involved.