# Compound: bad oracle price enables UNI borrow and swap profit

Compound's UniswapAnchoredView price feeder returned a stale/bad UNI price, letting an attacker borrow UNI cheaply, swap for USDC, and profit ~$439k.

- Payout: Real-world hack
- Severity: high
- Program: CompoundUni
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-23
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/CompoundUni_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240223-compounduni
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Compound's UniswapAnchoredView price feeder contract
**Root cause:** The UniswapAnchoredView price feeder provided an incorrect (likely stale or manipulated) price for UNI, allowing the attacker to borrow UNI at an undervalued price relative to market.
**Steps:**
1. Flash loan 193,020.25496 USDC from Balancer.
2. Approve and mint cUSDC with the USDC, then enter the cUSDC market.
3. Query account liquidity and calculate max UNI borrow using the faulty price from UniswapAnchoredView.
4. Borrow the maximum amount of UNI from cUniToken.
5. Swap borrowed UNI to WETH via Uniswap V3 UNI/WETH pool.
6. Swap WETH to USDC via Uniswap V3 WETH/USDC pool.
7. Repay the Balancer flash loan and keep the remaining USDC as profit.
**How found:** Attacker likely monitored Compound's price feeder for deviations from market prices, spotting an opportunity to borrow undervalued assets.
**Exploitation:** Attacker used a Balancer flash loan to supply USDC as collateral, then borrowed UNI at the manipulated/stale oracle price, swapped UNI→WETH→USDC on Uniswap V3, repaid the flash loan, and netted ~$439,537.
**Insight:** Oracle price feeds that rely on a single DEX pool or have stale updates can be exploited by borrowing the mispriced asset and swapping it on the same or correlated markets; always compare oracle price to broader market before borrowing.