# ZoomproFinance: price manipulation via Fake USDT pair sync

ZoomproFinance's swap contract priced Zoom via a manipulable Fake USDT/Zoom pair; attacker flash-loaned USDT, bought Zoom, inflated the pair with batchToken, synced, and sold Zoom for profit.

- Payout: Real-world hack
- Severity: high
- Program: ZoomproFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2022-09-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-09/ZoomproFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20220905-zoomprofinance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC swap contract and Fake USDT/Zoom PancakePair
**Root cause:** The swap contract's buy/sell pricing relied on the reserves of a Fake USDT/Zoom pair that could be arbitrarily inflated by calling batchToken on the Batch Token contract, then syncing the pair.
**Steps:**
1. Flash-loan 3,000,000 USDT from PancakePair KIMO/WBNB via `swap(3_000_000_000_000_000_000_000_000, 0, address(this), new bytes(1))`.
2. Approve USDT to the swap contract and call `buy(ba)` to acquire Zoom tokens.
3. Call `batchToken([pp], [1_000_000 ether], fUSDT)` on the Batch Token contract to mint/transfer 1,000,000 Fake USDT to the Fake USDT/Zoom pair `pp`.
4. Call `sync()` on the Fake USDT/Zoom pair to update its reserves with the inflated Fake USDT balance.
5. Approve Zoom to the swap contract and call `sell(baz)` to sell all acquired Zoom for USDT at the manipulated price.
6. Repay the flash loan with `Usdt.transfer(address(PancakePair), (ba * 10_030) / 10_000)` and keep the profit.
**Exploitation:** Attacker flash-loaned 3M USDT, used it to buy Zoom through the vulnerable swap contract, then minted 1M Fake USDT to the Fake USDT/Zoom pair via batchToken and called sync() to inflate the pair's Fake USDT reserve. This manipulated the price used by the swap contract's sell function, allowing the attacker to sell the Zoom back for more USDT than spent, repay the flash loan, and retain the profit.
**Insight:** When a swap contract prices tokens using a separate pair's reserves, check if those reserves can be arbitrarily changed by calling a token's batch/mint function and then sync() on the pair—this bypasses normal swap-based price impact.