# SpaceGodzilla: public swapAndLiquifyStepv1 skews LP for arbitrage

SpaceGodzilla's public swapAndLiquifyStepv1 injected contract-held tokens into its USDT LP, skewing reserves and letting an attacker arbitrage 25,378 BUSD.

- Payout: Real-world hack
- Severity: high
- Program: SpaceGodzilla
- Analysis by: DeFiHackLabs
- Disclosed: 2022-07-13
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-07/SpaceGodzilla_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220713-spacegodzilla
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BEP-20 token contract and its PancakeSwap USDT LP pool
**Root cause:** swapAndLiquifyStepv1, meant to be internal-only when adding liquidity, was left public; anyone could call it to dump the contract's own token and USDT balances into the LP, drastically shifting the pool ratio.
**Steps:**
1. Flash-loan ~2.95M USDT across 16 pools as initial capital.
2. Swap 2,952,797 USDT into the SpaceGodzilla/USDT CakeLP for ~73,775,430,786,944,730,258,898,675,433,018 tokens.
3. Call `ISpaceGodzilla(SpaceGodzilla).swapAndLiquifyStepv1()` to inject contract-held tokens/USDT into the LP, shifting reserves from ~8.4e8:1 to ~7.4e5:1.
4. Transfer remaining USDT plus all SpaceGodzilla tokens back into CakeLP.
5. Call `Uni_Pair_V2(CakeLP).swap(0, amount1Out, address(this), "")` to extract ~2,978,176 USDT, netting ~25,378 BUSD profit.
**How found:** Analysis of the token contract revealed swapAndLiquifyStepv1 was public rather than internal, and that it pushes contract balances into the LP, creating a manipulable reserve imbalance.
**Exploitation:** Attacker flash-loaned ~2.95M USDT from 16 pools, bought the token cheaply, called the public swapAndLiquifyStepv1 to distort LP reserves, then sold tokens back into the skewed pool for ~2.978M USDT, repaying loans and keeping ~25,378 BUSD.
**Insight:** On token contracts, enumerate every public/external function that moves contract-held balances into an AMM pool; leftover v1/test helpers like swapAndLiquifyStepv1 let anyone rebalance reserves and open a flash-loan arbitrage.

## Proof of concept (copied exactly from the original report)

**Vulnerable public swapAndLiquifyStepv1 function**

```
function swapAndLiquifyStepv1() public {
 uint256 ethBalance = ETH.balanceOf(address(this));
 uint256 tokenBalance = balanceOf(address(this));
 addLiquidityUsdt(tokenBalance, ethBalance);
 }
```