# SinstakeZombie: donation-funded dividend accounting drained via flash loan

SinstakeNetworkZombie dividend accounting let a flash-borrowed ZOMBIE balance donate, buy, sell and withdraw to extract excess ZOMBIE, netting 705 USD in WBNB.

- Payout: Real-world hack
- Severity: medium
- Program: SinstakeZombie
- Credited: DeFiHackLabs
- Disclosed: 2025-06-19
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/SinstakeZombie_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:reward-distribution

**Target:** BSC staking/dividend contract (SinstakeNetworkZombie) and ZOMBIE/WBNB BSCswap pair
**Root cause:** Donation-funded dividends are immediately claimable by a same-transaction buyer/seller, so a temporary ZOMBIE balance can mint pool shares, realize the dividend balance, and leave surplus ZOMBIE.
**Steps:**
1. Flash-borrow `FLASH_ZOMBIE_AMOUNT` ZOMBIE from the ZOMBIE/WBNB BSCswap pair via `swap(0, amount, this, data)`.
2. In the BSCswap callback, approve SINSTAKE_ZOMBIE and call `donatePool(DONATE_AMOUNT)` then `buy(BUY_AMOUNT)`.
3. Read `myTokens()`, call `sell(mintedPoolTokens)` then `withdraw()` to realize the dividend-funded ZOMBIE.
4. Repay the pair with `CALLBACK_PAIR_INPUT` ZOMBIE to satisfy the flash-swap invariant, keeping the excess.
5. Transfer remaining ZOMBIE to the pair and call `swap(WBNB_OUT, 0, profitReceiver, '')` to extract WBNB.
**Exploitation:** Attacker flash-borrowed ZOMBIE from the ZOMBIE/WBNB pair, used the donate/buy/sell/withdraw accounting path to pull more ZOMBIE from SinstakeNetworkZombie than the borrowed principal, repaid the flash swap, then sold the surplus ZOMBIE into the same pair for WBNB profit.
**Insight:** When a staking contract credits dividends from donations, test whether a same-block donate+buy+sell+withdraw cycle lets a flash-borrowed balance realize the donated value before the pool accounting settles.