# INUKO: flash-loan price manipulation drains bond rewards

INUKO bond contract priced LP via spot DEX reserves; attacker flash-loaned DODO pools to inflate LP value, bought bonds cheap, claimed inflated rewards.

- Payout: Real-world hack
- Severity: high
- Program: INUKO
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-14
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/INUKO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221014-inuko
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Bond contract + Uniswap V2 INUKO/USDT pair on BSC
**Root cause:** Bond purchase and reward calculation relied on manipulable spot LP/price from the INUKO-USDT Uniswap pair rather than a manipulation-resistant oracle.
**Steps:**
1. Fork BSC at block 22169169; fund attacker with 5 BNB.
2. Swap WBNB to USDT and INUKO via router; add USDT/INUKO liquidity, receive LP tokens; approve LP to Bond contract.
3. Flash-loan full reserves from DODO dodo1 (WBNB/USDT), then chain flash loans across dodo2..dodo8 to accumulate WBNB, USDT, BUSD, ETH, BTCB.
4. With manipulated INUKO price/LP value, call `Bond.buyBond(lpAmount, bondId)` to buy bonds cheaply.
5. Warp `block.timestamp + 3 days` to pass the vesting/time check.
6. Call `Bond.claim(index)` to claim inflated rewards, then sell INUKO for USDT.
7. Repay all DODO flash loans and keep remaining USDT (~$50k profit).
**Exploitation:** Attacker flash-loaned the entire reserves of eight DODO V2 pools in a nested chain, using the borrowed WBNB/USDT/BUSD/ETH/BTCB to manipulate the INUKO-USDT pair price and LP valuation. With the inflated LP, they bought INUKO bonds at a discount, waited 3 days via block.timestamp warp, claimed the reward, sold INUKO, and repaid all loans, netting ~$50k.
**Escalation:** Chained eight DODO flash loans to maximize capital and manipulate multiple pairs simultaneously, then used time warp to satisfy the bond vesting requirement.
**Insight:** Bond/reward contracts that price LP tokens or rewards from a single Uniswap V2 pair's spot reserves are flash-loan manipulable; check whether buyBond/claim read pair.balanceOf or getReserves directly and whether a TWAP/oracle is used.