# Palmswap: PLP exchange-rate manipulation drains ~$900K

Palmswap's PLP purchase/redeem exchange rate was manipulable, letting an attacker flash-loan BUSDT, mint PLP cheaply, and redeem for ~$900K profit.

- Payout: Real-world hack
- Severity: high
- Program: Palmswap
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-24
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/Palmswap_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230724-palmswap
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC vault and liquidity-event contracts (buyUSDP/sellUSDP, purchasePlp/unstakeAndRedeemPlp)
**Root cause:** PLP mint and redeem pricing used a manipulable exchange rate; buying USDP via the vault shifted the USDP/PLP ratio so a single transaction could mint PLP at 1:1 and redeem at ~1:1.9.
**Steps:**
1. Flash-loan 3,000,000 BUSDT from Radiant (`RadiantLP.flashLoan`).
2. Call `LiquidityEvent.purchasePlp(1_000_000e18, 0, 0)` to mint PLP at 1:1.
3. Transfer 2,000,000 BUSDT to Vault and call `Vault.buyUSDP(address(this))` to skew the USDP/PLP rate.
4. Call `LiquidityEvent.unstakeAndRedeemPlp(amountOut - 13_294e15, 0, address(this))` to redeem PLP at ~1:1.9 USDP.
5. Transfer `amountUSDP - 3154e18` USDP back to Vault and call `Vault.sellUSDP(address(this))` to convert to BUSDT.
6. Repay flash loan, keep ~$900K profit.
**How found:** Attacker observed that purchasePlp and unstakeAndRedeemPlp priced PLP off a vault-controlled USDP rate that could be moved within one transaction via buyUSDP/sellUSDP.
**Exploitation:** Single-transaction flash-loan attack: borrow BUSDT, mint PLP, manipulate the vault's USDP pricing via buyUSDP, redeem PLP at inflated rate, sell USDP back, repay loan and pocket the difference.
**Insight:** When a protocol mints LP/receipt tokens at one rate and redeems at another, check whether an in-protocol swap (buyUSDP/sellUSDP) can shift the redemption rate inside a single tx; flash loans make the capital cost zero.