# INK Finance: whitelist claimer bypass drains Workspace Treasury

INK Finance Workspace Treasury Proxy trusted a whitelisted-claimer check without validating entitlement; attacker flash-loaned USDT, passed claim(), and drained ~$140K.

- Payout: Real-world hack
- Severity: high
- Program: INKFinance
- Credited: DeFiHackLabs
- Disclosed: 2026-05-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/INKFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260511-inkfinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** Workspace Treasury Proxy / Workspace controller claim() on Polygon
**Root cause:** The Workspace controller's claim() authenticated the caller against a whitelisted-claimer set but never re-validated the amount the caller was entitled to; the treasury proxy trusted that approval and released funds with no ownership or balance-sanity gate.
**Steps:**
1. Deploy a malicious contract whose address passes the controller's whitelisted-claimer check (mimics a whitelisted claimer entry).
2. Take a ~24,982,654,321 (USDT units) flash loan from Balancer V2 Vault `0xBA12...F2C8`.
3. In `receiveFlashLoan`, transfer the borrowed USDT to the Treasury `0xa184...6Ee4` to satisfy the balance condition.
4. Call `claimPayroll(3)` on the payroll/controller `0xeF2C...3494`; the whitelist check passes and the treasury releases funds.
5. Repay the Balancer flash loan and sweep remaining USDT to the exploiter `0x90b1...7ee2`.
6. Net profit ~140,180,175,562 USDT units (~$140K).
**How found:** Blockaid flagged the on-chain incident; forensics showed the attacker deployed a contract mimicking a whitelisted claimer entry in the Workspace controller, exploiting the gap between caller authentication and entitlement validation.
**Exploitation:** Attacker pre-staged a malicious contract matching a whitelisted claimer, flash-borrowed ~$25K USDT from Balancer V2, seeded the treasury to satisfy the claim path's balance check, invoked claim() to trigger the treasury proxy's authorized transfer, then repaid the loan and swept ~$140K USDT in one atomic transaction.
**Escalation:** Flash loan inflated apparent eligibility/balance so a single claim extracted far more than the attacker's own capital would allow.
**Insight:** When a claim/withdraw path checks caller identity against a whitelist but computes payout from caller-supplied or caller-held balance, test whether a flash loan can inflate that balance inside the same tx — the whitelist proves who, not how much.