# Manipulate Allocations from game using flashloans

Derby Game lets a user flashloan USDC into derby tokens, rebalance, and push allocations to controller and vaults in one transaction, skewing protocol weights.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: oot2k
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/172
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-24
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:governance

**Target:** Game.sol allocation push functions (pushAllocationsToController / pushAllocationsToVaults)
**Root cause:** Allocation weight is derived from the user's current derby token balance, and pushAllocationsToController plus pushAllocationsToVaults can be called in the same transaction, so a temporary flashloan-funded balance inflates the pushed allocation.
**Steps:**
1. Flashloan USDC
2. Swap USDC to derby token on a DEX
3. Rebalance basket using these tokens to raise derby balance
4. Call `pushAllocationsToController`
5. Call `pushAllocationsToVaults` in the same transaction
6. Rebalance basket to recover tokens
7. Swap derby tokens back to USDC
8. Repay flashloan
**How found:** Reviewer noticed the two push functions can be invoked in the same transaction and that allocation weight depends on the caller's token balance, enabling a flashloan-funded temporary balance to skew weights.
**Exploitation:** Attacker flashloans USDC, buys derby tokens to temporarily inflate balance, rebalances their basket, then calls pushAllocationsToController and pushAllocationsToVaults in one transaction so the inflated weight is recorded, then unwinds and repays the loan.
**Insight:** When allocation or voting weight is read from a live token balance, check whether the weight-setting function and the balance-changing actions can occur in one transaction; same-tx push pairs are a flashloan amplification vector.