# UN token: flash-loan price manipulation drains Uniswap pair

UN token on BSC was drained ~$26k via flash-loan price manipulation of its Uniswap V2 pair using repeated skim calls.

- Payout: Real-world hack
- Severity: high
- Program: UN
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/UN_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230606-un
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Uniswap V2 UN/BUSD pair and DPPOracle flash loan
**Root cause:** UN token price on the Uniswap V2 pair could be manipulated within a single transaction using flash-loaned BUSD and repeated skim calls, letting the attacker buy UN cheap and sell it back at an inflated price.
**Steps:**
1. Flash loan 29,100 BUSD from DPPOracle via `flashLoan(0, 29_100 * 1e18, address(this), new bytes(1))`.
2. Swap all BUSD into the UN/BUSD pair to receive UN, driving UN price up.
3. Transfer 93% of UN balance to the pair and call `Pair.skim(address(this))` to extract excess.
4. Repeat skim with 90% and 80% of remaining UN to further skew reserves.
5. Swap the accumulated UN back into BUSD at the manipulated price.
6. Repay 29,100 BUSD to DPPOracle; keep the profit.
**Exploitation:** Attacker flash-borrowed 29,100 BUSD, swapped into the UN/BUSD pair to pump UN, then used repeated `skim` calls with large UN transfers to distort reserves further, then swapped UN back for BUSD at the inflated rate and repaid the loan, netting ~$26k.
**Insight:** Repeated `skim` calls on a Uniswap V2 pair can be used to repeatedly rebalance reserves and amplify price distortion beyond a single swap, so pairs with low liquidity and skim-exposed tokens are prime manipulation targets.