# AlkemiEarn: self-liquidation logic flaw drains 43.45 ETH

AlkemiEarn's liquidateBorrow allowed self-liquidation with inflated borrow balance, draining 43.45 ETH via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: AlkemiEarn
- Credited: DeFiHackLabs
- Disclosed: 2026-03-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/AlkemiEarn_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan vuln:liquidation

**Target:** AlkemiEarn lending contract
**Root cause:** liquidateBorrow does not validate that the borrower is not the liquidator, and the borrow balance used for liquidation can be manipulated via a flash loan, allowing self-liquidation to extract collateral.
**Steps:**
1. Flash loan 51 WETH from Balancer.
2. Withdraw WETH to ETH.
3. Supply 50 ETH as collateral to AlkemiEarn (aweth token).
4. Borrow 39.5 aweth against the collateral.
5. Call getBorrowBalance to get the inflated borrow amount.
6. Call liquidateBorrow with self as borrower, paying the borrow amount in ETH, to seize the collateral.
7. Withdraw all aweth collateral.
8. Repay flash loan and keep profit.
**Exploitation:** Attacker used a Balancer flash loan of 51 WETH, supplied 50 ETH as collateral, borrowed 39.5 aweth, then self-liquidated by calling liquidateBorrow with the inflated borrow balance, allowing them to withdraw all collateral and net 43.45 ETH profit.
**Insight:** Check for self-liquidation vulnerabilities in lending protocols: if a borrower can liquidate themselves, they can manipulate the borrow balance and seize their own collateral, especially when combined with flash loans.