# ARA: permission mishandling in swap contract enables price manipulation

ARA swap contract mishandled permissions, letting attacker manipulate price via flash loan and drain ~$125k.

- Payout: Real-world hack
- Severity: high
- Program: ARA
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/ARA_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230618-ara
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:access-control vuln:business-logic vuln:oracle-manipulation

**Target:** Swap contract on BSC
**Root cause:** The swap contract incorrectly handled permissions, allowing an approved address to execute swaps at manipulated prices.
**Steps:**
1. Flash loan 1,202,701 USDT from DPPOracle.
2. Call exploitable swap contract with `0x135b43e9` selector, swapping 163,497 ARA for 123,246 USDT.
3. Swap 1,202,701 USDT for 504,469 ARA via PancakeRouter V3 to pump ARA price.
4. Call swap contract again, swapping 132,123 USDT for 12,179 ARA, letting approved address take over ARA at high price.
5. Swap 504,469 ARA for 1,327,617 USDT via PancakeRouter V3.
6. Repay flash loan and keep profit.
**Exploitation:** Attacker used flash loan to manipulate ARA price on PancakeSwap, then exploited permission flaw in swap contract to buy/sell at favorable rates, netting ~$125k.
**Insight:** Check for permission flaws in swap contracts that allow approved addresses to execute trades at arbitrary prices, especially when combined with price manipulation via DEX.