# SellToken02: spot-price manipulation drains short mechanism

SellToken's short mechanism priced SELLC via a manipulable PancakeSwap pool; attacker pumped then dumped the token to profit from a short position, netting ~$197k.

- Payout: Real-world hack
- Severity: high
- Program: SellToken02
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/SellToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230513-selltoken
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** SellTokenRouter short/withdraw contract on BSC
**Root cause:** The router's getToken2Price derives token price from a PancakeSwap pool's getAmountOut, so an attacker who controls pool reserves controls the price used to open and settle shorts.
**Steps:**
1. Flash loan WBNB from DPPOracle.
2. Swap ~99% of borrowed WBNB into SELLC on PancakeSwap to pump SELLC price.
3. Call `s_router.setTokenPrice(address(SELLC))` to record the inflated price.
4. Open a short with `s_router.ShortStart{value: balance}(address(SELLC), address(this), 1)`.
5. Dump all SELLC back to WBNB on PancakeSwap to crash the price.
6. Call `s_router.withdraw(address(SELLC))` to settle the short at the crashed price, then repay the flash loan.
**How found:** Recognized that the router's price function reads directly from a DEX pool (getAmountOut), making it spot-price manipulable within a single transaction.
**Exploitation:** Attacker flash-borrowed WBNB, pumped SELLC on PancakeSwap, opened a short at the inflated price, dumped SELLC to crash the price, and settled the short at the depressed price, extracting the difference and repaying the flash loan.
**Insight:** When a protocol's price oracle is a DEX getAmountOut call, look for any function that opens or settles a position using that price — a flash-loan pump/dump around the open and settle calls extracts the spread.