# Flash loan balance inflation via self-transfer

Balance checks against live token/ETH balances that self-transfer or forced ETH can inflate

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-12-10. Updated 2026-11-06._

## How it works
A contract trusts a *live balance* (`address(this).balance`, `token.balanceOf(address(this))`) as proof that a payment, reserve, or repayment condition is met. That assumption breaks because balances can be raised without the intended deposit path: a token whose `transfer` mishandles self-transfers lets a holder loop transfers to itself and inflate its recorded balance at no cost [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md); forced ETH (selfdestruct) raises a contract's balance without any bid [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md); and a migration routine that mishandles liquidity tokens lets a flash-loaned position be manipulated into extracting value [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md). The check passes, but the value behind it was never paid.

## Where it shows up
- Reserve/repayment checks comparing `address(this).balance` or `balanceOf(this)` instead of a recorded amount [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md).
- ERC-20/BEP-20 `transfer`/`transferFrom` that updates balances without guarding `from == to` or re-reading state correctly [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md).
- Migration or liquidity functions that read pool/token balances mid-flow and act on them [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md).
- Any settle/repay path reachable in the same transaction as a flash loan [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md)[E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md).

## How to review
Find every condition that reads a live balance and ask: can this balance change without the caller paying? The invariant: *the value checked must equal the value the caller actually supplied through the intended path.* Compare against a stored `_auction.amount`/recorded bid, not the contract's balance [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md). For tokens, confirm self-transfer is a no-op on net balance and that a transfer loop cannot increase `balanceOf` [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md). For migration, confirm liquidity accounting uses tracked amounts, not spot balances [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md).

## How finders spotted it
- Read `_settleAuction` and noticed the reserve check used `address(this).balance` rather than the recorded bid, then asked how balance could be forced in without a deposit [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md).

## Variants seen
- Forced ETH via selfdestruct satisfying a raised reserve price on an ended auction [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md).
- Token self-transfer loop inflating balance, funded by a flash loan, then swapped out [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md).
- Migration function manipulated with flash-loaned liquidity to drain funds [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md).

## Impact and severity
Direct fund loss: 17.4 BNB netted in one token case [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md); auction settled below reserve, taking the NFT at the lower bid [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md); full liquidity drain in the migration case [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md). Severity rises with flash-loan funding (no capital needed) and same-transaction reach [E1](https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md)[E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20220409-gym-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01.md
- E3: https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md