# FireBirdPair: missing slippage in reserve fund swap drained

FirebirdReserveFund.sellTokensToUsdc swapped WMATIC to USDC with no slippage protection, letting an attacker manipulate reserves and drain ~3211 MATIC.

- Payout: Real-world hack
- Severity: high
- Program: FireBirdPair
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-30
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/FireBirdPair_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230930-firebirdpair
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** FirebirdRouter / FirebirdReserveFund / FireBirdPair on Polygon
**Root cause:** FirebirdReserveFund.sellTokensToUsdc performs a WMATIC->USDC swap with no amountOutMin (slippage) protection, so its output is fully determined by whatever pool reserves the attacker has manipulated.
**Steps:**
1. Flash loan 286000e18 WMATIC from Balancer.
2. Swap part of WMATIC to USDC via router on ce2c_FBP pair to set up.
3. Repeatedly swap WMATIC->HOPE on the WMATIC-HOPE FLP pair to deflate the HOPE reserve.
4. Call ReserveFund.collectFeeFromProtocol() to burn WMATIC-HOPE LP and mint manipulated liquidity fee.
5. Swap HOPE->WMATIC back on FLP.
6. Call ReserveFund.sellTokensToUsdc() which swaps WMATIC->USDC with no slippage protection at the manipulated price.
7. Swap USDC->WMATIC back on ce2c_FBP; repeat outer loop 3x, repay Balancer.
**Exploitation:** Attacker flash-borrows WMATIC, manipulates the WMATIC-HOPE pool reserves, triggers the reserve fund's unprotected WMATIC->USDC swap at a skewed price, then reverses the trades to capture the difference, repaying the flash loan.
**Escalation:** Outer loop of 3 iterations compounds the manipulation; total across txs ~8536 MATIC.
**Insight:** Protocol-owned reserve/fee-conversion functions that call AMM swaps without amountOutMin are prime sandwich/manipulation targets — check every internal swap path, not just user-facing router calls.