# Unifi Protocol: fake-pool injection drains reward manager UP

Unifi reward manager trusted a caller-supplied fake pool for LP eligibility and reward math, letting an attacker mint/claim the manager's entire UP balance and redeem it for ~5.86 BNB.

- Payout: Real-world hack
- Severity: high
- Program: UnifiProtocol
- Disclosed: 2026-09-09
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/UnifiProtocol_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260909-unifiprotocol
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC reward manager (mintUP/claimUP) + UPRedeemer
**Root cause:** The reward manager trusts a caller-supplied pool address for both LP eligibility (token0()==WBNB) and reward math (balanceOf/totalSupply) with no factory/registry/whitelist check, and requires only pool==msg.sender.
**Steps:**
1. Flash-swap 0.001 WBNB from PancakeV2 WBNB/BUSD pair `0x58F876857a02D6762E0101bb5C46A8c1ED44Dc16` via `swap(1e15,0,this,hex"00")`.
2. In pancakeCall, withdraw WBNB to BNB and call fake pool's `mintAndClaim{value:amount0}()`.
3. Fake pool implements `token0()=WBNB`, `totalSupply()=1e18`, `balanceOf()=6041339220182213708556` and calls `MANAGER.mintUP{value}(address(this))` then `MANAGER.claimUP(address(this),address(this),address(this))`.
4. Transfer stolen UP to exploit, `UP.approve(REDEEMER, bal)` and `REDEEMER.redeem(bal)` for ~5.86 BNB backing.
5. Repay flash swap `(amount0*10000)/9975+2` WBNB and keep surplus.
**How found:** Manager is unverified; root cause reconstructed from decoded attack trace showing mintUP/claimUP reading token0/balanceOf/totalSupply off the caller-supplied pool with no registry check.
**Exploitation:** Attacker deployed a contract that was both the fake pool and the caller (pool==msg.sender required). Fake balanceOf tuned so computed pending reward just equals the manager's whole UP balance (overshoot reverts). Stolen UP redeemed at UPRedeemer for over-collateralised BNB backing; flash swap repaid; ~5.859 BNB profit.
**Insight:** When a reward/LP contract is unverified, decode the attack trace to see which view functions it reads off caller-supplied addresses; any pool parameter used for both eligibility and math without a factory check is injectable by a contract implementing those views.