# MicDao swap price manipulation drains BUSDT via flash loan

MicDao swap contract mispriced BUSDT-to-MicDao swaps, letting an attacker flash-loan BUSDT, loop 80 swaps, and drain ~$13K.

- Payout: Real-world hack
- Severity: high
- Program: MicDao
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/MicDao_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231018-micdao
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC swap contract (0x1934...80b5) and MicDao token liquidity
**Root cause:** The swap contract's pricing logic allowed repeated BUSDT->MicDao swaps at a favorable/mispriced rate, so looping swaps extracted value from the pool.
**Steps:**
1. Flash-loan 99% of DPPOracle's BUSDT balance via `DPPOracle.flashLoan(0, quoteAmount, ...)`.
2. Approve Router and swap 500,000 BUSDT to MicDao via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Loop 80 times: deploy `HelperContract`, transfer 2000 BUSDT, call `SwapContract.swap(2000e18, owner)` to obtain MicDao, forward MicDao back to attacker, selfdestruct.
4. Swap accumulated MicDao back to BUSDT via Router.
5. Repay flash loan quoteAmount and keep profit.
**Exploitation:** Attacker flash-borrowed nearly all BUSDT from DPPOracle, seeded a large BUSDT->MicDao swap, then repeatedly invoked the vulnerable swap contract with 2000 BUSDT per call to receive MicDao at a manipulated rate, accumulating MicDao and selling it back for BUSDT before repaying the loan.
**Escalation:** Looped the mispriced swap 80 times via fresh helper contracts to amplify extraction.
**Insight:** When a project exposes its own swap() entrypoint separate from the AMM router, check whether its internal pricing can be driven by a large seed swap; loop small repeated calls to compound mispricing.