# SellToken04: miner price manipulation drains SELLC-USDT pool

SellToken miner contract's setBNB/sendMiner price manipulation let attacker inflate SELLC via flash loan and drain ~$109k from SELLC-USDT pool.

- Payout: Real-world hack
- Severity: high
- Program: SellToken04
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/SELLC03_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230611-sellc03
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC miner contract and SELLC-USDT Uniswap V2 pair
**Root cause:** The miner contract's setBNB and sendMiner functions allow an attacker to manipulate the SELLC token price by adding/removing liquidity and triggering miner rewards, which distorts the SELLC-USDT pool reserves.
**Steps:**
1. Call `miner.setBNB{value: 0.01 ether}(address(SELLC), address(USDT))` to initialize.
2. Warp time by 1 day + 1 second.
3. Take a flash loan of 600 WBNB from DPPOracle.
4. Swap 200 WBNB for SELLC via Router.
5. Swap 1% of SELLC balance for USDT via Router.
6. Add liquidity to SELLC-USDT pool with remaining SELLC and USDT.
7. Swap 400 WBNB for SELLC via Router.
8. Call `miner.sendMiner(address(SELLC))` to trigger miner reward.
9. Remove all SELLC-USDT liquidity.
10. Swap all SELLC for WBNB via Router.
11. Repay 600 WBNB to DPPOracle.
**Exploitation:** Attacker flash-loaned 600 WBNB, used part to buy SELLC, added liquidity to SELLC-USDT, bought more SELLC, called sendMiner to inflate SELLC price, removed liquidity at inflated price, sold SELLC for WBNB, and repaid flash loan, netting ~$109k.
**Insight:** Miner/reward contracts that can be triggered externally and interact with AMM pools are prime targets for price manipulation via flash loans; check if setBNB/sendMiner can be called by anyone to skew pool reserves.