# BoJLeverageMarket: liquidity index manipulation via flash-loan fees

Attacker flash-loaned cbBTC to inflate BoJ pool's liquidity index via repeated flash-loan fees, then borrowed multiple assets against inflated collateral.

- Payout: Real-world hack
- Severity: high
- Program: BoJLeverageMarket
- Credited: DeFiHackLabs
- Disclosed: 2025-07-21
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/BoJLeverageMarket_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250721-bojleveragemarket
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Aave-v3-derived lending pool (BoJ) on Base
**Root cause:** Flash-loan fee accumulation inflates the liquidity index while cbBTC aToken scaled supply is dust, allowing collateral value inflation.
**Steps:**
1. Flash-loan 10,537,110,432 cbBTC from Morpho.
2. Deposit 100 cbBTC into BoJ pool, then withdraw 99 to create 1 unit scaled supply.
3. Transfer 7,024,740,288 cbBTC directly to BoJ cbBTC aToken (donation).
4. Loop 150 times: call `pool.flashLoan` with 7,024,740,288 cbBTC, paying fees that compound into liquidity index.
5. Borrow WETH, USDC, AERO, MORPHO, DEGEN, VIRTUAL against inflated cbBTC collateral.
6. Use helper contract to deposit/withdraw cbBTC repeatedly, unwinding enough collateral to repay Morpho flash loan.
7. Transfer borrowed assets to attacker.
**Exploitation:** Attacker used Morpho flash loan for cbBTC, created minimal scaled supply in BoJ pool, donated cbBTC to aToken, then repeatedly flash-loaned cbBTC to accumulate fees into the liquidity index. This inflated the collateral value of the dust cbBTC position, allowing borrowing of multiple assets. Helper contract unwound inflated collateral to repay flash loan.
**Escalation:** Repeated flash loans (150x) compounded fees, amplifying index inflation; borrowed multiple listed assets.
**Insight:** In Aave-v3 forks, flash-loan fees accrue to the liquidity index; if scaled supply is near zero, a small donation plus repeated flash loans can massively inflate the index and collateral value. Check for pools with dust scaled supply and active flash loans.