Goose Finance StrategyGooseEgg vault exploited for $8,435 via share accounting flaw allowing attacker to claim unaccounted funds through flash loan deposit/withdrawal cycles.
Security & Exploits ·
The StrategyGooseEgg vault on Goose Finance was exploited for $8,435 on March 12, 2026, through a share accounting flaw that allowed an attacker to claim unaccounted funds within the contract. The vault held 3.69M EGG tokens worth approximately $11.3K that were not reflected in the wantLockedTotal or sharesTotal variables, creating an accounting gap that could be exploited.
The vulnerability lay in the _deposit() function's share calculation logic. When a user deposited funds, the function calculated shares based on the outdated wantLockedTotal before calling _farm(), which subsequently added both the new deposit and the previously unaccounted EGG to wantLockedTotal. This meant a depositor's shares entitled them to a proportional claim on those unaccounted tokens. The attacker exploited this by flash-swapping 10.17M EGG from two PancakeSwap pairs, depositing into pool 60 via VaultChef, and immediately withdrawing—receiving 12.59M EGG in return. After repeating this cycle twice, the attacker converted the profits to approximately 13.04 BNB.
The affected StrategyGooseEgg contract has now been identified, though it remains unclear whether the vault operator has deployed a patch or whether users have withdrawn remaining liquidity.