# BTC20: price manipulation in presale drains 18 ETH

BTC20 presale price manipulation via flash loans and Uniswap V3 flash swaps drained ~18 ETH from the presale contract.

- Payout: Real-world hack
- Severity: high
- Program: BTC20
- Analysis by: DeFiHackLabs
- Disclosed: 2023-08-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-08/BTC20_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230819-btc20
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** BTC20 presale contract and Uniswap V3 pools
**Root cause:** The presale contract's buyWithEthDynamic function calculates token price based on the current pool reserves, which can be manipulated via flash loans and large swaps.
**Steps:**
1. Flash loan 300 ETH from Balancer.
2. Flash swap SDEX from SDEX_BTC20_Pair3.
3. Flash swap BTC20 from BTC20_WETH_Pair3.
4. Swap WETH to BTC20 via Uniswap V2 to manipulate price.
5. Call PresaleV4.buyWithEthDynamic with 300 ETH to buy BTC20 at manipulated low price.
6. Swap BTC20 back to WETH to repay flash loans and profit.
**How found:** Likely identified that presale price depends on manipulable DEX reserves, then crafted flash loan attack to exploit price discrepancy.
**Exploitation:** Attacker used Balancer flash loan to borrow 300 ETH, then manipulated BTC20 price on Uniswap V3 and V2 pools via flash swaps, bought BTC20 cheaply from presale, and sold for profit, netting ~18 ETH.
**Insight:** Presale contracts that derive token price from DEX spot reserves are vulnerable to flash loan price manipulation; check for dynamic pricing based on manipulable sources.