# APC: flash-loan price manipulation in swap contract

APC swap contract priced trades off a manipulable spot price; flash-loan pump/dump of APC let attacker extract ~$6k in MUSD.

- Payout: Real-world hack
- Severity: high
- Program: - APC
- Analysis by: DeFiHackLabs
- Disclosed: 2022-12-01
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-12/APC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221201-apc
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** TransparentUpgradeableProxy swap contract on BSC
**Root cause:** The swap contract derived APC/MUSD exchange price from a manipulable on-chain spot price rather than a manipulation-resistant oracle, so a large trade moved the price used for the swap.
**Steps:**
1. Flash loan 500,000 USDT from DODO (`DVM(dodo).flashLoan(0, 500_000 * 1e18, ...)`).
2. Swap USDT->APC on PancakeSwap Router to pump APC price (`USDTToAPC()`).
3. Call `transSwap.swap(APC, MUSD, 100_000 * 1e18)` at the inflated price to receive excess MUSD.
4. Swap APC->USDT to dump APC price back down (`APCToUSDT()`).
5. Call `transSwap.swap(MUSD, APC, MUSD.balanceOf(this))` at the now-normal price to get more APC.
6. Sell obtained APC for USDT (`APCToUSDT()`), repay 500,000 USDT to DODO, keep profit.
**Exploitation:** Attacker flash-borrowed 500k USDT, pumped APC spot price via Router, swapped APC->MUSD on the vulnerable contract at the inflated price, dumped APC back down, then swapped MUSD->APC at the restored price and sold APC for USDT, repaying the loan and keeping ~$6k.
**Insight:** When a swap contract's quote is derived from a DEX spot price, check whether a single large trade can move that price within one transaction; a flash loan plus pump/dump around the swap call is the standard test.