LULA: pre-accumulated reward redeemed against a manipulable pool

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. The historical source/toolchain is unavailable; this entry is documentation only and claims no executable Forge PoC. Upstream DeFiHackLabs PoC: src/test/…/LULA_exp.sol.

Vulnerability classes: vuln/logic · vuln/access-control

Reproduction: a self-contained, faithful reconstruction of the incident's core bug — local deploy, no fork — both gates green (registry forge test PASS + browser Playground VERDICT: PASS). Basis: DeFiHackLabs PR #1209 (LULA_exp.sol, the upstream fork replay).

Key info#

Root cause#

LULA's reward payout redeems a pre-accumulated referral/team reward credit by SELLING the credited LULA into the LULA/USDT pair for USDT at the live spot, with no cap and no TWAP. Weeks earlier the attacker accumulated a large reward credit for free; redeeming it against the pool pays out far more USDT than was ever deposited, draining the pair (~578,295 USDT). In the live tx the attacker also flash-loaned USDT to sweep LULA out of the pair first, maximising the pool deflation and the payout. Every step is a public function driven by attacker-controlled on-chain state - no owner key, no privileged signer.

    // @> VULN: redeems the (free, pre-accumulated) reward by dumping the credited

Why it's exploitable here#

LULA's reward payout redeems a pre-accumulated referral/team reward credit by SELLING the credited LULA into the LULA/USDT pair for USDT at the live spot, with no cap and no TWAP. Weeks earlier the attacker accumulated a large reward credit for free; redeeming it against the pool pays out far more USDT than was ever deposited, draining the pair (~578,295 USDT). In the live tx the attacker also flash-loaned USDT to sweep LULA out of the pair first, maximising the pool deflation and the payout. Every step is a public function driven by attacker-controlled on-chain state - no owner key, no privileged signer.

Attack path#

Marked-line walkthrough (Playground)#

The EVM Playground pins each step to the exact executed source line:

1. L74 — Unbacked reward, no cap: The reward vault redeems a pre-accumulated credit by dumping the credited LULA into the pair - no cap, no TWAP.
2. L75 — Redeem the pre-accumulated reward: Root cause: claimReward sells the free, pre-accumulated reward LULA into the LULA/USDT pair at the live spot, so an oversized unbacked credit drains the pair's USDT.
3. L87 — Setup: the pair LULA reserve: Setup: the LULA/USDT pair's pre-attack reserves the reward redemption drains.
4. L88 — Setup: the pair USDT reserve: Setup: ~600K USDT backs the pair - the asset the attacker walks away with.
5. L89 — Setup: the pre-accumulated reward: Setup: ~12 days of prior referral/team accrual credited to the attacker for free.

PoC#

Registry (Foundry, local deploy — faithful reconstruction + harm-asserting test):

cd 2026-07-LULA_exp
forge test -vvv

The browser Playground replays the same synthetic opcode-for-opcode and measures the harm. Both gates are green (registry forge test PASS + Playground _verify-poc VERDICT: PASS).

Sources#

• Basis / upstream PoC: DeFiHackLabs PR #1209 — LULA_exp.sol (fork replay of the on-chain tx).
• DeFiHackLabs incident collection: SunWeb3Sec/DeFiHackLabs.

Sources & further analysis#

Reproductions & code

• No executable Forge reproduction is claimed; the historical source/toolchain was unavailable for this finding.
• Upstream DeFiHackLabs PoC: LULA_exp.sol.

Alerts & third-party analyses

• DeFiHackLabs incident explorer: search "LULA: pre-accumulated reward redeemed against a manipulable pool".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.