# An attacker can gain an inflated amount of Sherlock shares by staking when TrueFiPool2 pool has its value temporary reduced during loan closure

Permissionless TrueFi reclaim() swaps fees via attacker-controlled 1inch call while poolValue is temporarily depressed, letting attacker reenter Sherlock staking to mint inflated shares.

- Payout: Contest reward
- Severity: high
- Program: Sherlock
- Credited: hyh
- Disclosed: 2022-09-21
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2022-09-sherlock-judging/tree/main/018-H
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:oracle-manipulation vuln:reentrancy vuln:share-inflation

**Target:** TrueFiStrategy / FixedTermLoanAgency reclaim + 1inch swap callback into Sherlock staking
**Root cause:** FixedTermLoanAgency.reclaim() is permissionless and calls _swapFee() with user-supplied 1inch route data before repaying reclaimed funds to the pool, so TrueFiPool2.poolValue() is temporarily reduced by the loan value while an attacker-controlled contract executes arbitrary calls.
**Steps:**
1. Identify a settled FixedTermLoan with nonzero interest so feeAmount > 0 and _swapFee() runs.
2. Craft 1inch swap() calldata whose `calls` route targets an attacker contract that performs the required token swap AND calls Sherlock.initialStake() during execution.
3. Call `FixedTermLoanAgency.reclaim(loanToken, data)` permissionlessly; loan token is popped from poolLoans so ftlAgency.value() and poolValue() drop by loan_value.
4. Inside _swapFee -> OneInchExchange.exchange -> AggregationRouterV4.swap, attacker contract swaps fee tokens to satisfy balanceDiff check and reenters Sherlock staking while poolValue is depressed.
5. Sherlock mints stakeShares_ = (_amount * totalStakeShares_) / (totalTokenBalanceStakers() - _amount) using the reduced TrueFiStrategy balanceOf().
6. After swap returns, _redeemAndRepay repays fundsReclaimed - feeAmount to the pool, restoring poolValue; attacker's shares now priced at a premium.
**How found:** Code reading of TrueFi's reclaim() flow: noticed _swapFee() executes user-supplied 1inch route before pool.repay(), and that ftlAgency.value() drops when the loan is popped from poolLoans, creating a temporary poolValue() depression with an attacker-controlled external call in between.
**Exploitation:** Attacker needs a closed (Settled) FixedTermLoan with interest so fee swap executes. Supplies malicious 1inch route data; the called contract performs the swap to pass token/amount/receiver/slippage checks and additionally stakes into Sherlock during the depressed-valuation window. Premium equals loan_value proportion of shares, stolen from existing stakers.
**Escalation:** Premium scales with the size of the loan being reclaimed; larger loans yield larger share inflation.
**Insight:** When a protocol's share price depends on an external pool's poolValue(), look for permissionless functions that mutate that pool's accounting and make an external call (e.g. DEX aggregator route) before restoring balances — that window is a reentrancy surface for minting/depositing at a stale price.