# HoldSafe: oracle manipulation inflates HS stake and referral rewards

HoldSafe staking priced HS deposits and referral rewards via manipulable PancakeSwap route, letting a flash-loan attacker inflate stake value and drain ~$4.8k in HS rewards.

- Payout: Real-world hack
- Severity: high
- Program: HoldSafe
- Credited: DeFiHackLabs
- Disclosed: 2025-06-20
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/HoldSafe_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250620-holdsafe
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:reward-distribution

**Target:** BSC staking contract with PancakeSwap-priced HS deposits
**Root cause:** Stake and Rewards value HS via Pancake getAmountsOut on a manipulable HS/WBNB/USDT route; a temporary reserve change lets cheap HS satisfy the 2,000 USDT stake accounting while rewards are paid in HS.
**Steps:**
1. Flash-borrow 224 WBNB from DODO pool `0x172fcD41E0913e95784454622d1c3724f546f849`
2. Swap WBNB->HS on Pancake router `0x10ED43C718714eb63d5aA57B78B54704E256024E` to move HS price
3. Deploy StakeHelper, fund with HS, call `Stake(2000e18, referrer)` on `0x2496B87189D5Ae18d4d83b8a7039b0c8A07D98D4`
4. Repeat across 70 helpers building a referral chain, each staking max quoted USDT value in cheap HS
5. Loop 57 helpers calling `Rewards()` to claim referral rewards in HS
6. Swap claimed HS back to WBNB, repay 224.0224 WBNB to DODO, send surplus to attacker
**How found:** Attacker likely spotted that Stake and Rewards derive HS value from a spot Pancake getAmountsOut quote on a thin HS/WBNB/USDT route, making stake accounting and referral payouts manipulable within a single transaction.
**Exploitation:** Flash loan WBNB, dump into HS/WBNB pair to depress HS price so a small HS amount satisfies the 2,000 USDT stake valuation, spin up 70 staking accounts in a referral chain, claim referral rewards paid in HS, sell rewards for WBNB, repay flash loan, keep ~$4.8k surplus.
**Insight:** When a staking contract values deposits or pays rewards using a spot DEX quote, check whether a flash loan can move that pair's reserves enough to satisfy a fixed USD stake threshold with cheap tokens, then harvest rewards paid in the inflated asset.