# BelugaDex: LP price manipulation via flash loan drains pool

BelugaDex pool on Arbitrum was drained of ~$175K via repeated deposit/swap/withdraw cycles manipulating LP token pricing with flash-loaned funds.

- Payout: Real-world hack
- Severity: high
- Program: BelugaDex
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-13
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/BelugaDex_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231013-belugadex
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** BelugaDex liquidity pool contract on Arbitrum
**Root cause:** The pool's LP token pricing and withdrawal quote logic could be manipulated by large deposits and swaps within a single transaction, allowing an attacker to withdraw more value than deposited.
**Steps:**
1. Flash loan large amounts of USDT and USDCe from Balancer Vault.
2. Approve pool and LP tokens.
3. Loop 10 times: deposit USDT and USDCe into pool, swap USDCe to USDT, withdraw specific LP amounts (precomputed potentialWithdraws), swap USDT to USDCe, withdraw remaining USDT LP, swap USDCe to USDT, withdraw USDCe LP.
4. Repay flash loan and swap remaining tokens to ETH via SushiSwap.
**Exploitation:** Attacker flash-loaned ~2x USDCe and ~3x USDT reserves from Balancer, then repeatedly deposited and withdrew LP tokens while swapping between the two tokens to manipulate the pool's internal pricing, extracting excess value each cycle. Profits were swapped to ETH.
**Insight:** When a pool's LP token minting/burning relies on spot balances that can be skewed by large deposits and swaps within one transaction, test repeated deposit/withdraw/swap cycles with flash-loaned capital to see if each cycle yields net profit.