# NewFi Invest: missing slippage protection enables $31K drain

NewFi's Invest lacked slippage protection, letting an attacker flash-loan BUSD, swap to USDT at zero min-out, and drain ~$31K.

- Payout: Real-world hack
- Severity: high
- Program: NewFi
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/NewFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230717-newfi
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** StakedV3 Invest function on BSC
**Root cause:** The Invest function performed a swap without a minimum output amount (slippage protection), so an attacker could manipulate the pool price and force a bad trade.
**Steps:**
1. Flash loan BUSD from Pair1 via `Pair1.flash(address(this), 0, BUSD.balanceOf(address(Pair1)), ...)`.
2. Chain flash loans from Pair2 and Pair3 similarly.
3. Swap 12,000,000 BUSD to USDT via Router with `amountOutMinimum = 0`.
4. Call `StakedV3.Invest(2, 1 ether, 2, 1, 7, block.timestamp + 1000)` to trigger the vulnerable swap.
5. Swap all USDT back to BUSD via Router with `amountOutMinimum = 0`.
6. Repay flash loans and keep remaining BUSD (~$31K).
**Exploitation:** Attacker used nested flash loans to obtain large BUSD capital, swapped BUSD to USDT at zero slippage protection, called Invest to force a bad trade, then swapped back and repaid loans, extracting ~$31K.
**Insight:** Check DeFi functions that perform swaps for missing min-out parameters; even a small swap without slippage protection can be sandwiched or manipulated via flash loans.