# Huma Finance V1: refreshAccount bypasses EA credit approval, drains pools

Huma V1 BaseCreditPool let anyone requestCredit then refreshAccount to flip an unapproved line to GoodStanding, then drawdown drained ~$101K USDC across three Polygon pools.

- Payout: Real-world hack
- Severity: high
- Program: HumaFinance
- Credited: DeFiHackLabs
- Disclosed: 2026-05-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/HumaCreditApprovalBypass_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260511-humacreditapprovalbypass
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BaseCreditPool credit-line state machine (requestCredit/refreshAccount/drawdown)
**Root cause:** requestCredit() and refreshAccount() are permissionless, and _updateDueInfo() sets a credit line to GoodStanding after a billing period passes with no missed payment, without verifying the line was ever EA-approved.
**Steps:**
1. Call `requestCredit(maxCreditLine(), 1, 10)` on the pool to open a line in Requested state.
2. Call `refreshAccount(address(this))` to flip the unapproved line to GoodStanding.
3. Read `token.balanceOf(pool)` and call `drawdown(available)` to borrow the pool's full liquidity.
4. Repeat per pool (0x3EBc1 USDC, 0x95533 and 0xe8926 USDC.e) and transfer proceeds to attacker EOA.
**How found:** Code reading of the credit-line state machine: noticed requestCredit/refreshAccount are unauthenticated and that _updateDueInfo promotes to GoodStanding based only on elapsed billing period, not on EA approval.
**Exploitation:** Single transaction: for each of three Polygon V1 pools, open a max-limit credit line, self-refresh to GoodStanding, then drawdown the entire pool balance; sweep USDC and USDC.e to attacker EOA 0x13B44e416e0f66359502E843AF2e1191f1260DaF.
**Escalation:** Repeated the same primitive across three separate pools to aggregate ~$101.4K (82,315 USDC + 17,290 + 1,783 USDC.e).
**Insight:** In lending state machines, check every transition that grants borrowing power for an authorization gate; a time-based auto-promotion (billing period elapsed) can silently skip the human/EA approval step that requestCredit defers.