# Flamincome: permissionless stakeFor inflates Strategy NAV, drains VaultYUSDT

Permissionless Convex stakeFor inflated Flamincome Strategy NAV, letting VaultYUSDT shares redeem for ~$345.9K more USDT than deposited.

- Payout: Real-world hack
- Severity: high
- Program: Flamincome
- Disclosed: 2026-09-16
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/Flamincome_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260916-flamincome
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** VaultYUSDT vault and Convex USDP/3CRV Strategy on Ethereum
**Root cause:** Strategy prices its Convex position at spot get_virtual_price() with no time-weighting, and BaseRewardPool.stakeFor lets anyone credit the Strategy's Convex balance; the depegged USDP leg makes LP cheap to mint but valued at par.
**Steps:**
1. Morpho Blue flash loan USDT (fee-free)
2. VaultYUSDT.deposit(17,935,898.4848 USDT) to mint shares at honest NAV
3. Mint USDP/3CRV LP cheaply via LUSD metapool -> yvCurve-LUSD -> Balancer swap -> yvCurve-USDP unwrap, plus direct USDT->3CRV->metapool add_liquidity
4. Convex Booster.deposit(28, lp, false) to get deposit token
5. BaseRewardPool.stakeFor(Strategy, lp) to inflate Strategy.balanceOfY()
6. VaultYUSDT.withdrawAll() to redeem shares at inflated NAV
7. Repay flash loan; keep leftover USDT as profit
**How found:** Recognized that Strategy NAV uses spot virtual price and that Convex stakeFor is permissionless, then identified the depegged USDP leg as a cheap-LP source to inflate the credited balance.
**Exploitation:** Attacker flash-borrowed USDT, deposited into VaultYUSDT at honest NAV, cheaply minted depegged USDP/3CRV LP, permissionlessly staked it for the Strategy via Convex stakeFor to inflate NAV, then withdrew all shares at the inflated price and repaid the loan, netting ~$345.9K.
**Insight:** When a vault prices an external LP position at spot virtual price, check whether anyone can inflate that position's balance (e.g. permissionless stakeFor/donate) and whether the underlying pool is depegged so LP is cheap to mint but valued at par.