# Grizzifi: referral bonus logic flaw drains 61k USD

Grizzifi referral logic counted withdrawn totalInvested instead of active stake, letting 30 chained contracts farm referral bonuses and drain 61k USD.

- Payout: Real-world hack
- Severity: high
- Program: Grizzifi
- Credited: DeFiHackLabs
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/Grizzifi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** BSC staking/referral contract harvestHoney/collectRefBonus
**Root cause:** _incrementUplineTeamCount() checks totalInvested (which includes withdrawn amounts) rather than active investments, so referral/upline team counts can be inflated by depositing and withdrawing.
**Steps:**
1. Deploy 30 AttackContract1 instances, fund each with 20 BSC-USD.
2. Chain them as referrers: each calls `harvestHoney(0, 10 ether, regCenter)` with the previous contract as referrer, then spawns AttackContract2 which also calls `harvestHoney(0, 10 ether, regCenter)` to inflate upline team counts.
3. Call `collectRefBonus()` on each contract to claim inflated referral/milestone bonuses.
4. Transfer accumulated BSC-USD out; repeat across 30 contracts to drain pool.
**How found:** Researcher read _incrementUplineTeamCount and noticed it referenced totalInvested (cumulative, includes withdrawn) instead of active balance, implying team counts could be gamed by deposit/withdraw cycles.
**Exploitation:** Attacker deployed 30 contracts in a referral chain, each depositing 10 BSC-USD twice (direct + sub-contract) to inflate upline team counts, then called collectRefBonus to extract referral/milestone payouts exceeding deposits, netting ~61k USD.
**Escalation:** Scaling to 30 chained contracts multiplied the inflated team-count bonus extraction.
**Insight:** In referral/MLM-style DeFi, audit which accounting variable feeds upline/team counters: cumulative deposit totals that never decrement are a classic inflation vector—test deposit-then-withdraw loops against bonus thresholds.