# BankrollStackPlus: buyFor allowance abuse inflates dividends

BankrollStackPlus buyFor let anyone spend victims' LINK allowances to force pool buys, inflating dividends before attacker sold and withdrew.

- Payout: Real-world hack
- Severity: high
- Program: BankrollStackPlus
- Credited: DeFiHackLabs
- Disclosed: 2025-06-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/BankrollStackPlus_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250618-bankrollstackplus
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** DeFi dividend/share pool contract on Ethereum
**Root cause:** buyFor(customer, amount) pulls LINK from the customer via their existing allowance and mutates pool/dividend accounting for that customer, without requiring the customer's consent or restricting caller.
**Steps:**
1. Flash-borrow 13,635 LINK from Uniswap V4 PoolManager (modeled via vm.prank transfer).
2. Swap 7,800 LINK to WETH on Uniswap V2 Router.
3. Call `buy(5,835 LINK)` to acquire attacker shares.
4. For each of 6 pre-approved victims, call `buyFor(victim, victimAllowanceAmount)` to force LINK inflow and dividend accounting.
5. Call `sell(myTokens())` then `withdraw()` to extract boosted dividends.
6. Swap remaining WETH back to LINK, repay 13,635 LINK to PoolManager, send profit to attacker.
**How found:** Likely spotted that buyFor is public and pulls from customer allowance, allowing third-party forced buys that alter pool accounting; then identified accounts with large LINK allowances to the contract.
**Exploitation:** Attacker flash-borrowed LINK, bought shares, then used buyFor to spend six victims' existing LINK allowances, injecting LINK and fee/dividend accounting into the pool in the same transaction. Attacker then sold shares and withdrew, capturing inflated dividends, swapped WETH back to LINK, repaid flash loan, kept >900 LINK profit (~12,234 USD).
**Escalation:** Combined flash loan capital with multiple victims' pre-existing allowances in one transaction to amplify dividend inflation.
**Insight:** Look for public 'buyFor/onBehalfOf' functions that pull tokens via allowance and update share/dividend accounting for the target; enumerate existing allowances to the contract as free capital to manipulate pool math in one tx.