# EEE: price manipulation via flash loan and LP transfer

EEE token price manipulated via flash loan and direct LP transfers, draining ~$22.8K from a PancakeSwap pool.

- Payout: Real-world hack
- Severity: high
- Program: EEE
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-30
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/EEE_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231130-eee
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** PancakeSwap pool for EEE token
**Root cause:** The EEE token's price on PancakeSwap could be manipulated by directly transferring USDT to the LP and then swapping large amounts of EEE, exploiting the pool's reliance on spot reserves.
**Steps:**
1. Flash loan 750,000 USDT from PancakeSwap pool 0xa75C...01b0.
2. Transfer the borrowed USDT directly to the EEE-USDT LP contract (0x0506...c833) to inflate USDT reserves.
3. Call swap on the LP to withdraw 52,000,000 EEE tokens.
4. Approve and repeatedly swap EEE to USDT via a custom router (0x5002...E9Ea) to further manipulate price.
5. Transfer remaining EEE back to the LP and swap EEE for 188,300 USDT.
6. Repay the flash loan and keep the profit (~22.8K USD).
**Exploitation:** Attacker used a flash loan to borrow USDT, directly transferred it to the LP to skew reserves, then swapped EEE tokens at manipulated prices, extracting USDT profit.
**Insight:** Direct transfers to LP contracts can bypass swap logic and manipulate reserves; check if token contracts allow direct transfers to pairs and whether price oracles rely on spot reserves.