# Flash loan price manipulation in purchasePyroFlan()

purchasePyroFlan() prices flan from a single-point Uniswap LP balance, so a flash-loan sandwich skews the growth/premium calc to mint excess pyroflan.

- Payout: Audit contest
- Severity: high
- Program: Behodler
- Found by: sirhashalot
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/231
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** FlanBackstop.sol purchasePyroFlan() Uniswap flan/stablecoin LP pricing
**Root cause:** The flan/stablecoin price is read from Uniswap pool balances at a single point in time (line 83), and that spot price drives the growth variable and premium calculation. Spot balances are flash-loan manipulable.
**Steps:**
1. Observe purchasePyroFlan() computes priceBefore = (balanceOfFlanBefore * getMagnitude(stablecoin)) / balanceOfStableBefore from live LP balances.
2. Flash-borrow stablecoin/flan and swap to tilt the Uniswap flan/stablecoin pool price.
3. Call purchasePyroFlan() while the pool is tilted so growth and premium (lines 103/108) are computed off the skewed priceBefore.
4. Receive inflated flan/pyroflan; unwind the swap and repay the flash loan.
5. If acceptableHighestPrice (line 102) blocks a large tilt, reduce volume per flash loan and repeat the sandwich multiple times.
**How found:** Code review of FlanBackstop.sol: the in-code comment admitting flash-loan price manipulation risk, plus tracing that line 83 reads a single-point LP balance into growth (line 103) and premium (line 108), and that the line 102 require can be sidestepped with smaller repeated volumes.
**Exploitation:** Attacker flash-loans tokens to skew the flan/stablecoin Uniswap pool, calls purchasePyroFlan() to mint flan/pyroflan at the manipulated growth/premium, then reverses the swap and repays the loan, keeping the excess minted value. Larger volumes or repeated smaller attacks bypass the acceptableHighestPrice cap.
**Escalation:** Repeat smaller flash-loan sandwiches to stay under the acceptableHighestPrice require and accumulate the gain; low-liquidity/new pools amplify impact.
**Insight:** When a contract's own comment admits flash-loan manipulation risk, check whether its guard (here acceptableHighestPrice) bounds per-call price change only — if so, the cap is bypassable by splitting volume across repeated sandwiches rather than one large one.