# WUSD.fi: Sybil incentive abuse drains GLOVE liquidity pools

WUSD.wrap() minted GLOVE rewards to any fresh address with zero GLOVE balance, letting an attacker Sybil 80 helpers to farm incentives and drain thin GLO/USDC and GLO/USDT Uniswap V3 pools for ~$200K.

- Payout: Real-world hack
- Severity: high
- Program: WUSD.fi
- Credited: DeFiHackLabs
- Disclosed: 2026-05-25
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/WUSD_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260525-wusd
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** WUSD wrap/unwrap reward contract and Uniswap V3 GLO stablecoin pools
**Root cause:** _englove() gated reward eligibility only on msg.sender's current GLOVE balance (< _MAX_GLOVE) with no per-address ledger, cooldown, or identity binding, so every fresh address qualified for a fresh ~2 GLOVE mint per 100,000 WUSD wrap.
**Steps:**
1. Flash loan USDT from Morpho as working capital.
2. Deploy 80 fresh helper contracts, each funded 101,000 USDT (100,000 wrap + 1% fee).
3. Each helper calls `WUSD.wrap(USDT, 100_000e6, address(0))`, minting ~2 creditless GLOVE and advancing one global epoch.
4. Run 101 extra wrap/unwrap pump cycles to advance >=100 epochs so creditless GLOVE fully vests.
5. Each helper calls `unwrapAll()` to trigger `_deglove()`, vesting creditless GLOVE into credited GLOVE and returning USDT principal.
6. Each helper calls `dumpGlove(pool, recipient)` swapping its GLOVE into the thin GLO/USDC and GLO/USDT V3 pools.
7. Repay Morpho flash loan and keep drained USDC + USDT (~11,702 USDC + 8,079 USDT per 80-address batch).
**How found:** Recognized that reward eligibility read only the caller's live GLOVE balance with no claim ledger or cooldown, so a brand-new address always satisfies `gloves < _MAX_GLOVE`; then observed that each 100,000 WUSD wrap both mints GLOVE and advances an epoch, so a batch of Sybil wraps plus a short pump cycle vests the whole batch.
**Exploitation:** Attacker flash-borrowed USDT, spun up 80 fresh CREATE2 helper contracts each wrapping 100,000 WUSD to harvest ~2 creditless GLOVE apiece, pumped 101 extra wrap/unwrap cycles to advance 100 global epochs and fully vest the batch, unwrapped to convert creditless to credited GLOVE and recover principal, then each helper sold its GLOVE into the ~$63K-deep GLO/USDC and GLO/USDT Uniswap V3 pools, repaying the flash loan and keeping the drained stables.
**Escalation:** Batched 80 Sybil identities per transaction and pumped epochs to vest the entire batch at once, scaling the LP drain to the documented ~$200K-class incident.
**Insight:** When a reward gate reads only a live balance (not a per-address claim record), test whether fresh addresses always pass; also check whether the same action that mints the reward also advances the vesting clock, since that lets a single batch self-vest.