# 0vix: flash-loan price manipulation of vGHST collateral

0vix on Polygon was drained of ~$2M via flash-loan price manipulation of the deflationary vGHST token used as collateral.

- Payout: Real-world hack
- Severity: critical
- Program: 0vix
- Analysis by: DeFiHackLabs
- Disclosed: 2023-04-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-04/0vix_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230428-0vix
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** 0vix lending protocol on Polygon (vGHST collateral, oTokens)
**Root cause:** 0vix's price calculation for the deflationary vGHST token was flawed, allowing an attacker to inflate its collateral value via flash-loan-driven swaps and then borrow against it.
**Steps:**
1. Flash-loan USDT/USDC via Aave V3, Aave V2, and Balancer.
2. Deposit USDT collateral into 0vix (oUSDT.mint).
3. Manipulate vGHST price via swaps across Algebra, UniV2/V3, DMM, and Aavegotchi pools.
4. Use inflated vGHST as collateral to borrow other assets from 0vix.
5. Swap borrowed assets to USD/GHST, repay flash loans, keep profit.
**Exploitation:** Attacker flash-loaned stablecoins, deposited into 0vix, manipulated the vGHST price through multiple DEX pools, borrowed against the inflated collateral, swapped to USD/GHST, repaid loans, and kept ~$2M.
**Escalation:** Chained multiple flash-loan sources (Aave V3, Aave V2, Balancer) and multiple DEX pools to amplify the price manipulation.
**Insight:** Deflationary/rebasing tokens used as collateral in lending protocols are prime targets for price manipulation via DEX swaps; check how the protocol derives the token price and whether it can be moved with flash liquidity.