# RoeFinance: flash-loan LP price manipulation drains lending pool

RoeFinance lending pool priced WBTC/USDC LP collateral from a manipulable Uniswap V2 pair, letting a flash-loan attacker inflate collateral and drain $80k.

- Payout: Real-world hack
- Severity: high
- Program: - RoeFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2023-01-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-01/RoeFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230111-roefinance
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Lending protocol collateral oracle backed by Uniswap V2 LP pair
**Root cause:** RoeFinance valued the WBTC/USDC LP collateral using the spot reserves of a Uniswap V2 pair, which the attacker could move by burning/syncing the pair, so collateral value was inflated relative to real worth.
**Steps:**
1. Flash-borrow `5_673_090_338_021` USDC from Balancer vault `0xBA12...F2C8`.
2. `approveDelegation` on the vdWBTC_USDC_LP token so the attacker contract can act on the LP position.
3. `roe.deposit(USDC, balance, tx.origin, 0)` to seed collateral.
4. `roe.borrow(Pair, borrowAmount, 2, 0, tx.origin)` borrowing the entire LP balance held by `roeWBTC_USDC_LP`.
5. Loop 49x: `roe.deposit(Pair, borrowAmount, address(this), 0)` then `roe.borrow(Pair, borrowAmount, 2, 0, tx.origin)` to recursively inflate the LP position.
6. `Pair.transfer(Pair, borrowAmount)` then `Pair.burn(address(this))` to shrink LP supply.
7. `USDC.transfer(Pair, 26_025 * 1e6)` then `Pair.sync()` to skew reserves and inflate LP price.
8. `roe.borrow(USDC, flashLoanAmount, 2, 0, address(this))` to borrow out the inflated value.
9. Swap WBTC to USDC via Uniswap router and repay the Balancer flash loan.
**How found:** BlockSecTeam identified that the protocol's collateral valuation relied on a Uniswap V2 pair's spot reserves, which are directly controllable via burn/sync, making the LP price oracle manipulable within a single flash-loan transaction.
**Exploitation:** Attacker flash-borrowed ~5.67M USDC, recursively deposited/borrowed the WBTC/USDC LP to build a large LP position, then burned LP and synced the pair with a USDC donation to spike the LP token price. RoeFinance's oracle read that inflated price, letting the attacker borrow the full flash-loan amount in USDC against overvalued collateral, then swap and repay, netting ~$80k.
**Escalation:** Recursive deposit/borrow loop (49 iterations) amplified the LP position before the price skew, maximizing borrowable value.
**Insight:** When a lending protocol accepts Uniswap V2 LP tokens as collateral, check whether the price is derived from pair reserves; if so, a burn+sync donation can move the LP price arbitrarily, and recursive deposit/borrow loops amplify the borrowable amount.