# Carson: price manipulation in customized pair drains $150K

Carson's customized pair contract allowed price manipulation via repeated swaps, draining ~$150K from liquidity pools on BSC.

- Payout: Real-world hack
- Severity: high
- Program: Carson
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-26
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/Carson_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230726-carson
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:flash-loan vuln:oracle-manipulation

**Target:** Customized pair contract / DEX router on BSC
**Root cause:** The customized pair contract had a flaw in its pricing logic, allowing an attacker to manipulate token prices through repeated swaps.
**Steps:**
1. Flash loan BUSDT from multiple DPPOracle pools in sequence.
2. Approve Router to spend BUSDT and Carson.
3. Swap 1,500,000 BUSDT for Carson via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
4. Loop 50 times: swap 5000 Carson for BUSDT.
5. Swap remaining Carson balance for BUSDT.
6. Repay flash loans.
**Exploitation:** Attacker used flash loans to obtain large BUSDT capital, then manipulated the Carson/BUSDT price by swapping BUSDT to Carson and then repeatedly swapping Carson back to BUSDT, exploiting the customized pair's pricing to extract ~$150K.
**Insight:** Customized pair contracts with non-standard pricing logic are prime targets for price manipulation; test repeated swap patterns to detect invariant breaks.