# ElevateFi: reserve-price manipulation inflates staking rewards

ElevateFi priced fixed-USD staking packages from raw DAI/EFI pair reserves, letting an attacker pump spot price, open 100 underpriced stakes, and drain ~16k USD in EFI rewards.

- Payout: Real-world hack
- Severity: high
- Program: ElevateFi
- Credited: DeFiHackLabs
- Disclosed: 2026-05-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/ElevateFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260519-elevatefi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ElevateFi staking proxy on Polygon (stakeEFI/claimStakeRewards)
**Root cause:** getPriceUSD() derived EFI price directly from the DAI/EFI Uniswap V2 pair spot reserves, so a single-block swap moved the price used to value fixed-USD staking packages and rewards.
**Steps:**
1. Fund attacker with DAI (real tx used nested flash loans).
2. Swap all DAI into DAI/EFI pair via `pair.swap(0, efiOut, ATTACKER, "")` to pump EFI spot price.
3. Call `stakeEFI(7)` 100 times while price is inflated, buying packages cheaply in EFI terms.
4. Sell remaining EFI back into the pair to unwind manipulation.
5. Advance one epoch, call `rebase()`, read `viewStakeRewards(ATTACKER)`, then `claimStakeRewards(rewards)`.
6. Vault pays out inflated EFI rewards (~6,200+ EFI profit).
**How found:** Recognized that staking package pricing read raw AMM reserves (getPriceUSD from pair reserves), a classic spot-price oracle dependency, then tested whether a single-block swap could misprice fixed-USD packages and inflate claimable rewards.
**Exploitation:** Attacker obtained DAI via nested flash loans, pumped the DAI/EFI pair spot price, opened 100 package-7 stakes at the manipulated price, unwound the swap, advanced an epoch, and claimed EFI rewards from the staking vault worth ~16,000 USD.
**Escalation:** Scaled by opening 100 stakes in one transaction to multiply the mispriced reward accrual.
**Insight:** When a protocol quotes a 'fixed USD' price, check whether the USD conversion reads an AMM spot reserve directly; if so, a same-block swap before staking and unwind after lets you mint mispriced positions whose rewards are paid from a shared vault.