# DKP exchange: flash-loan manipulation of pair-balance price oracle

DKP exchange contract priced USDT→DKP swaps off the USDT-DKP pair balance ratio, letting a flash-loan attacker skew the pool and buy DKP cheap for ~$80K profit.

- Payout: Real-world hack
- Severity: high
- Program: - DKP
- Analysis by: DeFiHackLabs
- Disclosed: 2023-03-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-03/DKP_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230308-dkp
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Closed-source DKP exchange contract (0x89257) on BSC using USDT-DKP pair balances as price oracle
**Root cause:** The exchange() function in the closed-source 0x89257 contract computed the USDT→DKP price from the ratio of token balances in the USDT-DKP Uniswap V2 pair, which is directly manipulable via a large swap.
**Steps:**
1. Flash-borrow `USDT.balanceOf(Pair) * 9992 / 10_000` from the USDT-DKP pair via `Pair.swap(flashAmount, 0, ...)`.
2. In pancakeCall, deploy ExchangeDKP via CREATE2 and fund it with 100 USDT.
3. ExchangeDKP calls `DKPExchange.exchange(100 * 1e18)`, receiving DKP at the manipulated (skewed) pair-ratio price.
4. Repay the pair `returnAmount = flashAmount * 10_000 / 9975 + 1000` USDT.
5. Sell the acquired DKP back to USDT via `Router.swapExactTokensForTokensSupportingFeeOnTransferTokens`.
**How found:** Recognized that the closed-source exchange contract's pricing derived from live pair balances rather than a TWAP or external oracle, making it flash-loan manipulable.
**Exploitation:** Attacker flash-borrows nearly the entire USDT reserve of the USDT-DKP pair, skewing the balance ratio the DKP exchange uses as its oracle. With USDT now cheap relative to DKP in the pool, a fresh contract swaps 100 USDT for a large amount of DKP through exchange(), repays the flash loan, then dumps DKP on PancakeSwap for USDT, netting ~$80K.
**Insight:** When a contract's swap price is derived from spot reserves of a Uniswap V2 pair, a single flash swap that skews the ratio lets you mint value through any downstream exchange() that trusts that ratio; check closed-source contracts for balance-ratio pricing.