# DEUS DAO: oracle manipulation and forged signatures drain DeiLender

DEUS DAO's DeiLender on Fantom was drained via flash-loan-funded price oracle manipulation and forged Schnorr signatures, netting ~$1.5M in USDC.

- Payout: Real-world hack
- Severity: critical
- Program: DEUS DAO
- Analysis by: DeFiHackLabs
- Disclosed: 2022-04-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-04/deus_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220428-deus
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:flash-loan vuln:oracle-manipulation vuln:signature-replay

**Target:** DeiLenderSolidex lending contract on Fantom
**Root cause:** The lending contract trusted an on-chain oracle price that could be skewed by large swaps, and accepted Schnorr signatures without proper verification, allowing an attacker to borrow against inflated collateral.
**Steps:**
1. Fork Fantom at block 37093708.
2. Impersonate USDC owner `0xC564EE9f21Ed8A2d8E7e76c085740d5e4c5FaFbE` and call `usdc.Swapin(txHash, address(this), 150_000_000 * 10**6)` to obtain 150M USDC.
3. Approve and call `sspv4.buyDei(1_000_000 * 10**6)` to acquire DEI.
4. Add liquidity to the DEI/USDC pool via `router.addLiquidity` with large amounts.
5. Deposit LP tokens into `LpDepositor` to receive DepositToken.
6. Approve DepositToken and call `DeiLenderSolidex.addCollateral(address(this), balance_of_DepositToken)`.
7. Swap USDC to DEI via `router.swapExactTokensForTokensSimple` to manipulate price.
8. Craft a Schnorr signature struct and repID, then call `DeiLenderSolidex.borrow` with large amounts.
9. Swap borrowed DEI back to USDC and repay the 150M USDC to the owner.
**Exploitation:** Attacker flash-loaned/impersonated 150M USDC, bought DEI, added liquidity, deposited LP as collateral, manipulated the oracle price via swaps, forged Schnorr signatures to borrow excessive DEI, swapped DEI to USDC, and repaid the principal, keeping the profit.
**Insight:** Lending protocols that rely on spot DEX prices and custom signature schemes are vulnerable to flash-loan-driven oracle manipulation and signature forgery; always verify oracle sources and signature validation logic.