# Flash-loan atomic reward and price capture

Atomic buy, lock, or unwrap paths that capture rewards or bypass timing gates

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-08-04. Updated 2026-10-30._

## How it works
A protocol assumes that a state transition (graduation, maturity, presale purchase) reflects real, time-separated user commitment. When the same transaction can both fund the qualifying action and consume its benefit, that assumption breaks: borrowed capital satisfies the gate, the reward or conversion is taken, and the loan is repaid atomically. The invariant that must hold is that no value-bearing transition can be completed within one transaction funded by repayable capital.

## Where it shows up
- Conversion or redeem paths (unwrap, withdraw, claim) callable in the same transaction as the qualifying buy or lock.
- Graduation or threshold gates with no time restriction between trigger and post-graduation conversion [E1](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-04.md).
- Lock/deposit functions that accept zero amounts, or start timers before the real deposit [E2](https://bugbountylibrary.com/r/dhl%3A20230513-bitpaidio.md).
- Fixed-price sale functions with no per-user cap while the token already trades on a DEX [E3](https://bugbountylibrary.com/r/dhl%3A20230424-axioma.md).
- Reward emission logic keyed to balances that can be inflated and deflated atomically.

## How to review
Trace every path that grants a benefit (reward, conversion, withdrawal, discounted purchase) and ask what funded the qualifying state and when. Safe designs enforce at least one of: a minimum lock/deposit amount validated at open time, a maturity or cooldown measured from the real deposit, a per-address purchase cap, or a check that the qualifying action and the benefit occur in different blocks. Confirm accounting tracks per-plan balances rather than trusting the initial call [E2](https://bugbountylibrary.com/r/dhl%3A20230513-bitpaidio.md), and that graduation cannot be triggered and unwound atomically [E1](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-04.md).

## Variants seen
- Flashloan buy forces graduation, then atomic unwrap captures emissions [E1](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-04.md).
- Zero-amount lock opens a plan; flash-loaned top-up is instantly withdrawable [E2](https://bugbountylibrary.com/r/dhl%3A20230513-bitpaidio.md).
- Fixed-price presale with no cap arbitraged against a live DEX pair [E3](https://bugbountylibrary.com/r/dhl%3A20230424-axioma.md).

## Impact and severity
Losses ranged from ~21 WBNB [E3](https://bugbountylibrary.com/r/dhl%3A20230424-axioma.md) to ~$30K [E2](https://bugbountylibrary.com/r/dhl%3A20230513-bitpaidio.md), plus reward-emission manipulation [E1](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-04.md). Severity rises when the benefit is a direct token drain and when no cap or cooldown limits repetition; atomicity makes detection and recovery harder.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-04.md
- E2: https://bugbountylibrary.com/r/dhl%3A20230513-bitpaidio.md
- E3: https://bugbountylibrary.com/r/dhl%3A20230424-axioma.md