# BH: price manipulation via Upgrade and liquidity ratio exploit

BH token price manipulated via repeated Upgrade calls and liquidity add/remove, draining ~$1.27M from BUSDT-BH pool.

- Payout: Real-world hack
- Severity: high
- Program: BH
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/BH_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231011-bh
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:oracle-manipulation

**Target:** BUSDT-BH liquidity pool and UnverifiedContract1
**Root cause:** UnverifiedContract1's Upgrade function and liquidity add/remove functions allow manipulation of the BUSDT-BH pool's price and liquidity ratio, enabling profit from imbalanced swaps.
**Steps:**
1. Flash loan BUSDT from multiple DPP oracles and PancakeSwap V2/V3.
2. Approve BUSDT and BH to UnverifiedContract1 and Router.
3. Call UnverifiedContract1.Upgrade(lpToken) 12 times.
4. Call UnverifiedContract1 with selector `0x33688938` and 3,000,000 BUSDT to add liquidity.
5. Swap 22,000,000 BUSDT for BH via Router to unverifiedContractAddr2, skewing the pool.
6. Call UnverifiedContract1 with selector `0x4e290832` and 55% of BH balance in busdt_bh_lp, 10 times, to remove liquidity at favorable ratio.
7. Repay flash loans and keep remaining BUSDT as profit.
**Exploitation:** Attacker flash-loaned large BUSDT amounts, repeatedly called Upgrade to manipulate pool state, added liquidity, swapped BUSDT to BH to shift price, then removed liquidity at a favorable ratio, extracting ~$1.27M in BUSDT.
**Insight:** Look for unverified contracts with functions like Upgrade that can be called repeatedly to alter pool state, and check if liquidity add/remove functions allow ratio manipulation when combined with large swaps.