# UPSToken: business logic flaw in myPressure drains Uniswap pool

UPSToken's myPressure logic was manipulated via repeated LP skim transfers, inflating token balance and draining ~22 ETH from the Uniswap pool.

- Payout: Real-world hack
- Severity: high
- Program: - UPSToken
- Analysis by: DeFiHackLabs
- Disclosed: 2023-01-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-01/Upswing_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230118-upswing
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** ERC20 token contract and Uniswap V2 pair
**Root cause:** The token's myPressure function likely calculates a value based on balance or transfer history, which can be inflated by repeatedly transferring tokens to the LP and calling skim, artificially increasing the pressure metric.
**Steps:**
1. Swap 1 ETH for UPS tokens via Uniswap router, receiving ~199,388 UPS.
2. Log myPressure before manipulation.
3. Loop 8 times: transfer entire UPS balance to the LP pair, then call lp.skim(address(this)) to recover tokens, inflating myPressure.
4. Log myPressure after fake swaps.
5. Transfer 0 UPS to self (no-op).
6. Approve router and swap all UPS back to WETH, receiving more WETH than initial due to manipulated pressure.
**How found:** Likely discovered by analyzing the token's myPressure function and noticing it could be manipulated via repeated transfers and skim calls to the LP.
**Exploitation:** Attacker flash-loaned or used own 1 ETH to buy UPS, then repeatedly transferred UPS to the LP and skimmed it back, artificially inflating the myPressure metric. This allowed selling UPS back at a higher price, netting ~22 ETH profit.
**Insight:** Tokens with custom balance-based logic (like myPressure) can be vulnerable to manipulation via repeated transfers to liquidity pools and skim calls, especially if the metric affects swap pricing or rewards.