# TheStandard_io: missing slippage protection enables $290K drain

TheStandard_io vault swap lacked slippage protection, letting an attacker manipulate a WBTC/PAXG pool and drain ~$290K via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: TheStandard_io
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-06
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/TheStandard_io_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231106-thestandard-io
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** SmartVaultV2 swap function and Uniswap V3 WBTC/PAXG pool
**Root cause:** SmartVaultV2.swap executed a token swap without a minimum output amount (slippage protection), allowing the attacker to manipulate the pool price and extract value.
**Steps:**
1. Attacker pre-funds exploit contract with 100e9 PAXG.
2. Create and initialize a WBTC/PAXG Uniswap V3 pool at a manipulated price via `PositionsNFT.createAndInitializePoolIfNecessary`.
3. Flash loan 1,000,000,010 WBTC from WBTC/WETH pool.
4. Mint a new SmartVault via `SmartVaultManagerV2.mint()`.
5. Transfer WBTC to vault and call `SmartVaultV2.mint(address(this), 290_000 * 1e18)` to mint vault tokens.
6. Mint a concentrated WBTC/PAXG position with `amount0Min=0, amount1Min=0`.
7. Call `SmartVaultV2.swap(WBTC, PAXG, 1e9)` which swaps at the manipulated price with no slippage check.
8. Decrease liquidity and collect WBTC/PAXG from the pool.
9. Swap EURO to USDC and USDC to WBTC via routers with `amountOutMinimum=0`.
10. Repay flash loan and keep profit.
**How found:** Likely identified that SmartVaultV2.swap had no minimum output parameter, enabling price manipulation via a controlled Uniswap V3 pool.
**Exploitation:** Attacker used a flash loan to obtain WBTC, created a SmartVault, minted vault tokens, then called the vault's swap function which lacked slippage protection. By pre-seeding a WBTC/PAXG pool at an extreme price, the vault's swap executed at a highly unfavorable rate, transferring value to the attacker's position. The attacker then withdrew liquidity and swapped back to WBTC to repay the flash loan, netting ~$290K.
**Insight:** When auditing vault swap functions, check for missing `amountOutMinimum` or equivalent slippage parameters; an attacker can create a low-liquidity pool and manipulate its price to drain funds via the unprotected swap.