# Themis: flash-loan price manipulation drains lending reserves

Themis lending pool on Arbitrum was drained of ~$370k by flash-loan-manipulating the wstETH/WETH Balancer pool used as a price oracle, then borrowing all reserves against a tiny WETH collateral.

- Payout: Real-world hack
- Severity: high
- Program: Themis
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/Themis_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230628-themis
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Lending pool / Balancer wstETH-WETH price oracle
**Root cause:** Themis derived collateral value from a manipulable Balancer wstETH/WETH spot pool rather than a manipulation-resistant oracle, so a large flash-loan swap could inflate the attacker's WETH collateral value.
**Steps:**
1. Flash-loan 22,000 WETH from Aave V3.
2. Nested flash loans: 10,000 WETH from Uniswap V3 pool 1, then 8,000 WETH from Uniswap V3 pool 2.
3. Approve WETH/wstETH to Balancer Vault, Themis, and gauge; call `Aggregator.latestAnswer()`.
4. `AttackedThemisContract.supply(WETH, 220e18, address(this), 0)` and `setUserUseReserveAsCollateral(WETH, true)`.
5. Borrow the entire DAI, USDC, USDT, ARB, and WBTC balances from Themis via `borrow(token, balance, 2, 0, address(this))`.
6. Withdraw 55 WETH, deploy AttackContract, swap wstETH->WETH on Balancer to restore pool and repay flash loans.
7. Swap borrowed DAI/USDC, WETH/ARB, WBTC/WETH on Uniswap V3 to realize profit.
**Exploitation:** Attacker flash-borrowed WETH, supplied a small 220 WETH position to Themis, then used the borrowed capital to manipulate the Balancer wstETH/WETH pool that Themis used for pricing, inflating collateral value enough to borrow out all reserves (~$370k), then unwound positions and repaid flash loans.
**Escalation:** Nested Uniswap V3 flash loans plus Aave flash loan to accumulate enough capital to move the Balancer pool price.
**Insight:** Lending protocols pricing collateral from a single Balancer/Uniswap spot pool are flash-loan-manipulable; check whether the oracle reads pool balances directly and whether a nested flash loan can move that pool within one tx.