# Allbridge: flash-loan price manipulation drains bridge pool

Allbridge Bridge pool on BSC was drained of ~$550k via flash-loan price manipulation of its BUSD/BSC-USD swap ratio.

- Payout: Real-world hack
- Severity: high
- Program: Allbridge
- Analysis by: DeFiHackLabs
- Disclosed: 2023-04-02
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-04/Allbridge_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230402-allbridge
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Allbridge Bridge contract and associated liquidity pools on BSC
**Root cause:** The bridge's swap pricing relied on spot pool balances that the attacker could skew by large deposits/withdrawals, letting them swap at a manipulated rate.
**Steps:**
1. Flash-loan 7.5M BUSD from PancakeSwap pair `0x7EFaEf62fDdCCa950418312c6C91Aef321375A00`.
2. Swap 2,003,300 BUSD for BSC-USD in pool `0x312Bc7eAAF93f1C60Dc5AfC115FcCDE161055fb0`.
3. Deposit 5,000,000 BUSD into pool `0x179aaD597399B9ae078acFE2B746C09117799ca0`.
4. Swap 496,700 BUSD for BSC-USD in pool `0x312B`.
5. Deposit 2,000,000 BSC-USD into pool `0xB19Cd6AB3890f18B662904fd7a40C003703d2554`.
6. Call `bridge.swap(BSC_USD_bal, bsc_usd, busd, address(this))` on `0x7E6c2522fEE4E74A0182B9C6159048361BC3260A` to get inflated BUSD dividend.
7. Withdraw 4,830,262,616 LP from pool `0x179a`.
8. Call `bridge.swap(40_000e18, busd, bsc_usd, address(this))` to extract ~790k BSC-USD.
9. Withdraw 1,993,728,530 LP from pool `0xb19c`.
10. Swap all BSC-USD back to BUSD in pool `0x312B`.
11. Repay 7,522,500 BUSD flash loan and transfer profit to attacker.
**Exploitation:** Attacker flash-borrowed 7.5M BUSD, used large deposits/withdrawals across Allbridge pools to skew the bridge's internal swap ratio, then swapped small amounts for outsized returns and unwound positions, netting ~$550k.
**Insight:** Bridge swap pricing that reads live pool balances is manipulable: check whether a single large deposit/withdraw can move the implied exchange rate before a swap.