# LW: flash loan price manipulation drains market

LW token's price function manipulable via flash loan and repeated skim/swap cycles, draining ~$50k from market contract.

- Payout: Real-world hack
- Severity: high
- Program: LW
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/LW_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230512-lw
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:flash-loan vuln:oracle-manipulation

**Target:** LW token contract and PancakeSwap LP pair
**Root cause:** LW token price derived from LP reserves that can be manipulated via large swaps and skim operations, allowing attacker to profit from price discrepancies.
**Steps:**
1. Flash loan 1,000,000 USDT from PancakeSwap Pair via `Pair.swap(1_000_000 * 1e18, 0, address(this), new bytes(1))`.
2. In callback, swap USDT to LW via Router.
3. While USDT balance of marketAddr > 3000e18: call `LW.thanPrice()`, compute `transferAmount = 2510e18 * 1e18 / LW.getTokenPrice()`, transfer LW to LP, call `LW.thanPrice()`, call `LP.skim(address(this))`, and send 1 wei to LW to trigger swap.
4. Swap accumulated LW back to USDT via Router.
5. Repay flash loan with 1,002,507 USDT.
**Exploitation:** Attacker flash-loans 1M USDT, swaps to LW, then repeatedly manipulates LW price by transferring LW to LP and skimming, triggering swaps that drain USDT from the market contract. Finally swaps LW back to USDT and repays loan, keeping profit.
**Insight:** Tokens with price functions based on manipulable LP reserves are vulnerable to flash loan attacks; repeated skim/swap cycles can amplify extraction.