# VINU: fake-router liquidity injection manipulates pair price

VINU token's addLiquidityETH trusted a caller-supplied router address, letting an attacker fake liquidity and manipulate the Uniswap pair price for ~$6k profit.

- Payout: Real-world hack
- Severity: medium
- Program: VINU
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/VINU_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230606-vinu
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** VINU ERC20 token addLiquidityETH function and Uniswap V2 pair
**Root cause:** VINU.addLiquidityETH accepts an arbitrary routerAddr and lprAddr from the caller and performs liquidity/pair operations against them without validating they are the legitimate Uniswap router/pair, so an attacker-supplied fake router can be used to distort the real pair's reserves.
**Steps:**
1. Buy VINU with 0.1 ETH via UniswapV2Router02.swapExactETHForTokens.
2. Deploy a fake Router contract implementing factory(), WETH(), approve(), createPair(), addLiquidityETH() returning zeros.
3. Call `VINU.addLiquidityETH(address(FakeRouter), address(this), address(Pair))` four times to inflate the attacker's VINU balance via the fake router path.
4. Call `Pair.sync()` to update reserves, then `VINU.transfer(address(Pair), VINU.balanceOf(address(this)))` to dump VINU into the pair.
5. Read reserves via `Pair.getReserves()`, compute `amountOut = UniswapV2Router02.getAmountOut(amountIn, reserveVINU, reserveWETH)`.
6. Call `Pair.swap(amountOut, 0, address(this), "")` to extract WETH.
**Exploitation:** Attacker flash-funded 0.5 ETH, bought VINU, deployed a fake router, repeatedly invoked VINU.addLiquidityETH against the fake router to mint/credit VINU to themselves, synced and dumped the VINU into the real Uniswap pair, then swapped the inflated VINU balance out for WETH via Pair.swap, netting ~$6k.
**Insight:** When a token exposes a liquidity helper that takes router/pair addresses as parameters, check whether it validates them against the canonical factory; a fake router returning zero amounts can be used to mint or mis-account balances and then dump into the real pair.