# ATK: flashswap price manipulation drains claimReward contract

ATK token's getPrice() was manipulable via a PancakeSwap flashswap, letting an attacker inflate ATK price and drain ~127K BUSD from the reward-claim contract.

- Payout: Real-world hack
- Severity: high
- Program: ATK
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-12
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/ATK_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221012-atk
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token getPrice() and closed-source deposit/claimReward contract
**Root cause:** The claimReward() payout relies on ATK token's getPrice(), which derives price from the ATK/BUSDT PancakeSwap pair reserves; those reserves are manipulable within a single transaction via flashswap.
**Steps:**
1. Wrap 2 BNB to WBNB and swap to BUSDT via PancakeSwap router.
2. Compute `swapamount = BUSDT.balanceOf(ATK_BUSDT_PAIR) - 3e18` and call `ATK_BUSDT_PAIR.swap(swapamount, 0, address(this), new bytes(1))` to drain BUSDT from the pair, crashing ATK price.
3. In pancakeCall callback, prank as EXPLOIT_CONTRACT and call `claimToken1()` on the aux contract, which reads the now-manipulated getPrice() to claim an outsized ATK reward.
4. Repay the pair `swapamount * 10_000 / 9975 + 1000` BUSDT and keep the profit.
**Exploitation:** Attacker flash-borrowed BUSDT from the ATK/BUSDT pair to skew reserves, invoked claimToken1() on the vulnerable contract while price was distorted, then repaid the flashswap and netted ~127K BUSD.
**Insight:** When a reward/claim contract prices tokens via an AMM pair's spot reserves, a single flashswap that shifts those reserves lets you mint claims at a distorted price; check any getPrice() that reads pair balances directly.