# BankrollNetwork: dividend miscalculation drained via flash loan

BankrollNetwork's dividend accounting was manipulated via donatePool/buy/sell, letting an attacker drain 24.5 WBNB through a flash-loan-funded exploit.

- Payout: Real-world hack
- Severity: high
- Program: BankrollNetwork
- Credited: DeFiHackLabs
- Disclosed: 2025-06-19
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/BankrollNetwork_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250619-bankrollnetwork
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** BSC staking/dividend contract (BankrollNetworkStack)
**Root cause:** Dividends are computed from a manipulable pool balance/token ratio; donating to the pool then buying/selling inflates the attacker's myDividends() beyond real contributions.
**Steps:**
1. Flash-borrow 2000 WBNB from PancakeSwap pair `0x16b9...0daE` via `swap(0, 2000e18, attacker, "0x3030")`
2. In `pancakeCall`, approve BankrollNetwork for max WBNB
3. Call `donatePool(1000 ether)` to inflate pool balance
4. Call `buy(240 ether)` to acquire tokens at manipulated ratio
5. Read `myTokens()`/`myDividends()` showing inflated dividends
6. Call `sell(myTokens())` to exit position
7. Transfer `94064984776383565540` wei WBNB top-up to contract, then `withdraw()` to collect dividends
8. Repay 2005.2 WBNB to pair, keep ~24.5 WBNB profit
**How found:** Post-mortem analysis (Phalcon/TenArmor) of on-chain attack tx identified the donatePool+buy+sell+withdraw sequence as the dividend-inflation vector.
**Exploitation:** Flash loan 2000 WBNB, donate 1000 WBNB to the pool to skew the dividend-per-token math, buy tokens, sell them, then withdraw inflated dividends; repay loan and keep the difference.
**Insight:** In dividend/reward contracts, check whether pool balance or token supply used in reward math can be moved by a single actor within one transaction; a donate-then-buy-then-withdraw sequence is a classic inflation pattern.