# pSeudoEth: Uniswap V2 pair skim manipulation drains pool

pEth Uniswap V2 pair price manipulated via flash-loaned WETH swap and repeated skim() calls, draining ~1.4 ETH from the pool.

- Payout: Real-world hack
- Severity: medium
- Program: pSeudoEth
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/pSeudoEth_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231008-pseudoeth
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Uniswap V2 pEth/WETH pair and pEth token
**Root cause:** The pEth/WETH Uniswap V2 pair's reserves could be manipulated by directly transferring pEth to the pair and calling skim() repeatedly, desynchronizing price from the token's real backing and letting the attacker swap back at an inflated rate.
**Steps:**
1. Flash-loan `51_970_861_731_879_316_502_999` WETH from Balancer Vault `0xBA12...F2C8`.
2. Swap WETH -> pEth via Uniswap V2 Router `0x7a25...488D` using `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Transfer all pEth balance directly to the pair `0x2033...1161`.
4. Call `UNIPair.skim(address(UNIPair))` 10 times in a loop to push excess tokens into reserves.
5. Swap pEth -> WETH back through the router at the manipulated rate.
6. Repay flash loan `amount` WETH to Balancer; keep profit.
**Exploitation:** Attacker flash-borrows ~52k WETH, buys pEth on the pair, donates pEth to the pair, calls skim() repeatedly to inflate reserves, then sells pEth back for more WETH than spent, repays loan and keeps ~1.4 ETH profit.
**Insight:** Fee-on-transfer or rebasing tokens paired on Uniswap V2 can be manipulated by direct transfers plus repeated skim() calls; check whether reserve accounting trusts balanceOf rather than internal accounting.