# Grok token: slippage protection missing enables $26 ETH exploit

Grok token lacked slippage protection in Uniswap V2/V3 pools, allowing an attacker to manipulate price and drain ~26 ETH via flash loans.

- Payout: Real-world hack
- Severity: high
- Program: grok
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/grok_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231110-grok
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** Uniswap V2/V3 pools involving Grok token
**Root cause:** The Grok token's trading logic or pool setup lacked slippage protection, allowing an attacker to manipulate the price through large swaps and profit from the discrepancy.
**Steps:**
1. Flash loan 30,000 WETH from Uniswap V3 WETH pair.
2. Flash loan 63,433,590,767,572,373 Grok from Uniswap V3 Grok pair.
3. Swap 30,695,631,768,482,954 Grok for WETH via Uniswap V2 router with 0 slippage.
4. Transfer 2,737,958,999,089,419 Grok to the Grok token contract (likely to trigger fee or rebase).
5. Swap 30,000,000,000,000,000 Grok for WETH via Uniswap V2 router with 0 slippage.
6. Swap WETH for 64,067,926,675,248,097 Grok via Uniswap V2 router.
7. Transfer all Grok to the Uniswap V3 Grok pair.
8. Swap 30,000,000,000,000,000,000 Grok for WETH via Uniswap V2 router with 0 slippage.
9. Repay flash loans and keep remaining WETH as profit.
**Exploitation:** The attacker used flash loans to obtain large amounts of WETH and Grok, then executed a series of swaps with zero slippage protection to manipulate the price of Grok in Uniswap V2 and V3 pools. By transferring tokens directly to the pair and performing large swaps, the attacker exploited the lack of slippage checks to extract ~26 ETH.
**Insight:** When a token's liquidity pools lack slippage protection, an attacker can use flash loans to manipulate the price and profit from the discrepancy; always check if swaps have amountOutMinimum set to zero.