# Edel xStock: ERC4626 donation inflates wGOOGLx oracle, drains reserves

Edel xStock lending oracle priced wGOOGLx via mutable ERC4626 convertToAssets; attacker donated GOOGLx to inflate collateral and borrowed 204k USDC plus wrapped xStock reserves.

- Payout: Real-world hack
- Severity: critical
- Program: edel-xstock
- Credited: DeFiHackLabs
- Disclosed: 2026-07-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-07/edel-xstock_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260701-edel-xstock
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Lending market oracle / ERC4626 wrapper collateral (Edel pool proxy on Ethereum)
**Root cause:** The lending market's oracle valued wrapped xStock collateral through the wrapper's mutable ERC4626 convertToAssets() exchange rate, so a direct underlying donation to the wrapper inflated collateral value within the same transaction.
**Steps:**
1. Flash loan 180,000 USDC from Morpho Blue.
2. Supply USDC to Edel pool as collateral via `supply(USDC, assets, this, 0)`.
3. Loop 40x: read `wGOOGLx.balanceOf(EWGOOGLX)`, `borrow(wGOOGLx, reserveBalance, 2, 0, this)`, transfer to helper, `helper.supplyWGooglx(reserveBalance)`.
4. Borrow remaining wGOOGLx reserve, `redeem` it to GOOGLx, then `transfer` all GOOGLx to the wGOOGLx wrapper to inflate `convertToAssets()`.
5. Call `helper.borrowAndForward` for USDC, wSPYx, wQQQx, wMSTRx, wNVDAx, wTSLAx to drain reserves against inflated collateral.
6. Approve Morpho to pull flash loan repayment; forward profits to attacker.
**How found:** Attacker recognized the oracle read collateral value from the wrapper's mutable ERC4626 convertToAssets() rate, which is directly manipulable by donating underlying tokens to the wrapper within the same transaction.
**Exploitation:** Attacker flash-borrowed 180k USDC from Morpho, supplied it as collateral, recursively borrowed and re-supplied the entire wGOOGLx reserve through a helper contract to build a large collateral position, then redeemed a final wGOOGLx borrow to GOOGLx and donated the underlying directly to the wrapper. This inflated the ERC4626 convertToAssets() rate, making the helper's wGOOGLx collateral appear far more valuable, and the attacker borrowed out all USDC and wrapped xStock reserves (wSPYx, wQQQx, wMSTRx, wNVDAx, wTSLAx), netting 204,215.57 USDC plus the wrapped assets.
**Escalation:** Recursive borrow/resupply loop amplified the collateral base before the donation, maximizing the oracle inflation and letting the attacker drain every borrowable reserve in the pool, not just USDC.
**Insight:** When a lending market prices an ERC4626 wrapper as collateral, check whether the oracle uses live convertToAssets()/totalAssets() rather than a manipulation-resistant feed; a direct donation to the wrapper inflates share price atomically, and recursive borrow/resupply of the same reserve can amplify the position before the donation.