# TIFIToken: flash-loan LP price manipulation drains borrow pool

TIFIFinance priced TIFI borrows off a manipulable WBNB/BUSD LP reserve, letting a flash-loan attacker inflate collateral and drain 87 WBNB.

- Payout: Real-world hack
- Severity: high
- Program: - TIFIToken
- Analysis by: DeFiHackLabs
- Disclosed: 2022-12-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-12/TIFI_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20221210-tifi
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** TIFIFinance lending contract on BSC
**Root cause:** TIFI borrow amount is computed from WBNB-BUSD LP reserves that the attacker can shift within a single transaction, so collateral valuation is manipulable.
**Steps:**
1. Flash-swap 5 WBNB / 500 BUSD from the WBNB-BUSD Pair via `Pair.swap(5 * 1e18, 500 * 1e18, address(this), new bytes(1))`.
2. In `pancakeCall`, deposit borrowed BUSD into TIFI: `TIFI.deposit(address(BUSD), BUSD.balanceOf(address(this)))`.
3. Swap WBNB to BUSD via TIFIRouter to move the WBNB-BUSD reserves (`WBNBToBUSD`).
4. Call `TIFI.borrow(address(TIFIToken), TIFIToken.balanceOf(address(TIFI)))` to drain TIFI tokens against the manipulated reserve.
5. Swap drained TIFI to WBNB via the Pancake Router (`TIFIToWBNB`).
6. Repay the flash swap with `WBNB.transfer(address(Pair), 7 * 1e18)`.
**Exploitation:** Attacker flash-borrows WBNB/BUSD, deposits BUSD as collateral, manipulates the WBNB-BUSD LP reserves with a swap, then borrows the entire TIFI balance from TIFIFinance at the skewed price, sells TIFI for WBNB, repays the flash loan and keeps ~87 WBNB profit.
**Insight:** When a lending protocol values collateral or debt via an AMM pair's `getReserves`, a flash swap that shifts those reserves before the borrow call lets you borrow far more than your real collateral; check whether the price source is a spot reserve read inside the same tx.