# EGD Finance: price oracle manipulation inflates reward claim

EGD Finance reward calculation used manipulable EGD/USDT LP price; attacker flash-loaned to crash price, then claimed inflated EGD rewards.

- Payout: Real-world hack
- Severity: high
- Program: EGD Finance
- Analysis by: DeFiHackLabs
- Disclosed: 2022-08-07
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-08/EGD_Finance_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220807-egd-finance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:flash-loan vuln:oracle-manipulation vuln:reward-distribution

**Target:** EGD Finance staking/reward contract on BSC
**Root cause:** Reward calculation relied on spot price from EGD/USDT PancakeSwap pair, which could be manipulated via large flash loan swap.
**Steps:**
1. Stake 100 USDT into EGD Finance via `stake(100 ether)` after setting invitor with `bond(0x659b136c49Da3D9ac48682D02F7BD8806184e218)`.
2. Flash loan 2,000 USDT from USDT/WBNB PancakeSwap pair via `swap(2000e18, 0, address(this), "0000")`.
3. In callback, flash loan 99.99999925% of USDT from EGD/USDT pair via `swap(0, borrow2, address(this), "00")`, drastically lowering EGD price.
4. Call `claimAllReward()` on EGD Finance to claim EGD tokens at manipulated low price.
5. Swap claimed EGD to USDT via PancakeRouter.
6. Repay flash loans with fees and keep profit.
**How found:** Likely identified that reward calculation used spot price from a low-liquidity PancakeSwap pair, enabling flash-loan price manipulation.
**Exploitation:** Attacker used nested flash loans to manipulate EGD/USDT pool price, then claimed rewards at inflated EGD amount, swapped to USDT, repaid loans, and profited ~36,044 USDT.
**Insight:** Check if reward or collateral calculations use spot prices from DEX pairs; low-liquidity pairs are prime targets for flash-loan manipulation.

## Proof of concept (copied exactly from the original report)

**Stake 100 USDT pre-work**

```
function stake() public {
        // Give exploit contract 100 USDT
        deal(address(usdt), address(this), 100 ether);
        // Set invitor
        IEGD_Finance(EGD_Finance).bond(address(0x659b136c49Da3D9ac48682D02F7BD8806184e218));
        // Stake 100 USDT
        IERC20(usdt).approve(EGD_Finance, 100 ether);
        IEGD_Finance(EGD_Finance).stake(100 ether);
    }
```