# MONA LisaVault: self-referral node farming drains vault

MONA LisaVault on BSC drained via self-referral node purchases through proxy contracts plus deployer LP removal, netting ~60,950 USDT.

- Payout: Real-world hack
- Severity: high
- Program: MONA LisaVault
- Credited: DeFiHackLabs
- Disclosed: 2026-04-14
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/MONA_LisaVault_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** BSC staking vault contract (LisaVault) and MONA/USDT PancakeSwap LP
**Root cause:** Vault pays both L1 (70 USDT) and L2 (50 USDT) referral rewards per 220 USDT node purchase without preventing the buyer from controlling both referrer tiers; per-address node limit bypassed by deploying fresh proxy contracts. Deployer also held the entire MONA/USDT LP, enabling a coordinated drain.
**Steps:**
1. Fork BSC at block 92,429,267.
2. Pre-register L2 referrer via HELPER `bindReferrer(address)` selector `0x04f618cb`.
3. Impersonate VAULT_OWNER, approve MONA_LP to Pancake router, call `removeLiquidity(MONA, USDT, lpBalance, 0, 0, VAULT_OWNER, deadline)`; transfer USDT proceeds to attack contract.
4. Deploy 25 `NodeBuyer` proxy contracts, each calling `bindReferrer(attack)` then `buyNode()` (selector `0xb9c4788c`) with 220 USDT approval to VAULT.
5. Each node pays 70 USDT to L1 (attack) and 50 USDT to L2 (attacker-controlled), recovering 120/220 USDT per node.
6. Call `claim()` (selector `0x3af10fe2`) on each buyer to collect MONA dividends, sweep tokens back.
7. Net profit ≈ 60,950 USDT.
**How found:** Attacker likely observed that the vault pays both referral tiers per node and that the per-address node limit is enforced only on msg.sender, allowing fresh proxy contracts; also that the deployer held 100% of the MONA/USDT LP, making a coordinated LP pull possible.
**Exploitation:** Attacker used a ListaDAO:Moolah WBNB flash loan as inflated collateral to borrow USDT, then deployed 25 proxy contracts each buying one 220 USDT node with the attacker registered as both L1 and L2 referrer, recovering 120 USDT per node. Combined with redeeming the deployer-controlled MONA/USDT LP (66,450 USDT routed to attacker) and MONA dividend sales, extracted ~60,950 USDT from stakers and LP.
**Escalation:** Chained LP removal (insider LP ownership) with self-referral farming across 25 proxy contracts to bypass the 1-node-per-address limit and multiply referral payouts.
**Insight:** When a contract pays multi-tier referral rewards, check whether the buyer can be both tiers and whether per-address limits are keyed on msg.sender (bypassable via fresh proxy contracts); also check if the deployer/LP owner holds the entire liquidity, which turns a reward bug into a full drain.