# Channels: price manipulation drains lending pool

Channels lending protocol on BSC was exploited via price manipulation of its collateral token, allowing attacker to borrow and drain ~$4.4K.

- Payout: Real-world hack
- Severity: high
- Program: Channels
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-31
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/Channels_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231231-channels
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Compound-fork lending protocol on BSC
**Root cause:** The protocol used a manipulable PancakeSwap pool as a price oracle for its collateral token, allowing an attacker to inflate the collateral value and borrow excessively.
**Steps:**
1. Flash loan 1 BNB and 42,218e18 BUSD from PancakeV3 pool.
2. Deposit BUSD and BTCB into the BUSD-BTCB PancakeSwap pair, minting LP tokens.
3. Transfer LP tokens and CAKE to the Channels protocol contract (channels1) to accrue interest and enter markets.
4. Enter markets for cUSDC and cBUSD, then borrow all USDC and BUSD from those markets.
5. Redeem underlying from channels1, then burn the LP tokens to withdraw BUSD and BTCB.
6. Swap USDC to BTCB via PancakeRouter exactOutput to repay the flash loan.
7. Repay flash loan with fees, keeping the remaining borrowed funds as profit.
**Exploitation:** Attacker used a flash loan to manipulate the price of the BUSD-BTCB LP token, which was used as collateral in Channels. By inflating the collateral value, they borrowed all available USDC and BUSD from the protocol, then redeemed and swapped assets to repay the flash loan, netting ~$4.4K.
**Insight:** Lending protocols that rely on DEX pool spot prices for collateral valuation are vulnerable to flash-loan price manipulation; check if the collateral token's price can be moved within a single transaction.