# ElephantStatus: unprotected sweep() enables WBNB price manipulation

ElephantStatus's unprotected sweep() let an attacker flash-loan BUSD, buy WBNB, call sweep to pump WBNB price, then sell WBNB for profit.

- Payout: Real-world hack
- Severity: high
- Program: ElephantStatus
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/ElephantStatus_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231206-elephantstatus
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:access-control vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC smart contract (ElephantStatus) and PancakeSwap V3 pools
**Root cause:** The sweep() function is publicly callable and manipulates WBNB price without access control or price-oracle safeguards.
**Steps:**
1. Flash-loan BUSD from USDC_BUSD, BUSDT_BUSD, WBNB_BUSD, BTCB_BUSD PancakeSwap V3 pools in sequence.
2. Approve PancakeRouter for BUSD and WBNB.
3. Swap all BUSD to WBNB via PancakeRouter, raising WBNB price.
4. Call Elephant.sweep() to further raise WBNB price.
5. Swap WBNB back to BUSD via PancakeRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens.
6. Repay flash loans and keep remaining BUSD as profit.
**Exploitation:** Attacker used nested flash loans from four PancakeSwap V3 pools to obtain large BUSD capital, swapped BUSD for WBNB to push price up, called the unprotected sweep() to further inflate WBNB price, then sold WBNB back for BUSD at the manipulated high price, repaying loans and extracting ~$165k.
**Insight:** Look for public functions that alter token balances or prices without access control; they can be chained with flash loans to manipulate AMM spot prices.