# Gamma Hypervisor: price manipulation via flash loan drains $6.3M

Gamma Hypervisor deposit/withdraw used stale pool price, allowing flash-loan manipulation to mint/withdraw at skewed ratio and drain ~$6.3M.

- Payout: Real-world hack
- Severity: critical
- Program: Gamma
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-04
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/Gamma_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240104-gamma
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical technique:chained vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** Gamma Uniproxy Hypervisor deposit/withdraw on Arbitrum
**Root cause:** Hypervisor deposit/withdraw computed share value from a manipulable Algebra pool price without a TWAP or slippage check, so an attacker could skew the pool price and mint/withdraw at an advantageous ratio.
**Steps:**
1. Flash loan 3M USDT from WETH/USDT pool.
2. Flash loan 2M USDC.e from Balancer.
3. Swap USDT into Algebra pool to push price down (calculatePrice returns globalState.price * 0.85572).
4. Loop 15 times: deposit 300k USDT into Gamma uniproxy (usdt_usdce_pool), withdraw shares, swap USDC.e back into Algebra pool, deposit 1 USDC.e.
5. Swap remaining USDC.e into WETH/USDC.e pool to extract WETH.
6. Withdraw WETH to ETH, repay flash loans, keep profit.
**Exploitation:** Attacker used nested flash loans (Uniswap V3 + Balancer) to obtain capital, manipulated the Algebra pool price via large swaps, then repeatedly deposited and withdrew from Gamma's Hypervisor at the manipulated price to mint shares cheaply and redeem them for more valuable assets, finally swapping to WETH and cashing out ~$6.3M.
**Escalation:** Repeated deposit/withdraw loop amplified the price discrepancy, extracting more value per iteration.
**Insight:** Hypervisor-style vaults that price shares using spot pool reserves are vulnerable to flash-loan price manipulation; check if deposit/withdraw uses a TWAP or external oracle.