# NeverFall: flash-loan price manipulation drains BUSD/USDT pool

NeverFall token price manipulated via flash-loaned USDT on PancakeSwap; attacker bought cheap, sold inflated, netting ~74K.

- Payout: Real-world hack
- Severity: high
- Program: NeverFall
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-03
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/NeverFall_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230503-neverfall
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:flash-loan vuln:oracle-manipulation

**Target:** BEP-20 token contract and PancakeSwap BUSD/USDT pair on BSC
**Root cause:** NeverFall's buy/sell pricing derives from spot reserves of a PancakeSwap pair, so a large flash loan skews the price used by the token's own buy/sell functions.
**Steps:**
1. Flash-borrow 1,600,000 USDT from BUSD/USDT pair via `swap(flashLoanAmount, 0, address(this), ...)`.
2. In `pancakeCall`, approve USDT to NeverFall and router.
3. Call `INeverFall(neverFall).buy(200_000 * 1e18)` to acquire tokens at manipulated price.
4. Swap 1,400,000 USDT into NeverFall via `swapExactTokensForTokensSupportingFeeOnTransferTokens` to push price up.
5. Call `INeverFall(neverFall).sell(75_500_000 * 1e18)` to dump at inflated price.
6. Repay flash loan plus 0.3% fee and keep remaining USDT.
**Exploitation:** Single-transaction flash loan from the BUSD/USDT PancakeSwap pair funds a buy of NeverFall, a large swap to inflate its price, then a sell of the inflated token balance back into the pool; profit repays the loan and leaves ~74K USDT.
**Insight:** Tokens whose buy/sell price reads a PancakeSwap pair reserve are manipulable in one tx; check whether the token's own pricing function uses spot reserves rather than a TWAP.