# WooFi WooPPV2 oracle price manipulation drains ~$8M

WooPPV2 oracle price manipulation via large USDC/WOO swaps in a flash-loan-funded attack drained ~$8M from the WooFi pool on Arbitrum.

- Payout: Real-world hack
- Severity: critical
- Program: Woofi
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-05
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/Woofi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240305-woofi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** WooPPV2 swap/oracle on Arbitrum
**Root cause:** WooPPV2 swap pricing relies on WooracleV2 state that can be skewed by large swaps against the pool, letting an attacker move the quoted price and swap at a favorable rate.
**Steps:**
1. Flash-borrow USDCe from Uniswap V3 USDCe/WETH pool (`uni_flash_amount = balance - 10_000_000_000`).
2. Flash-borrow WOO from the WOO/WETH LBT pool.
3. Deposit 7,000,000 USDCe into Silo as collateral and borrow all available WOO liquidity.
4. Swap 2,000,000 USDCe -> WETH on WooPPV2 to skew oracle state.
5. Swap 100,000 USDCe -> WOO on WooPPV2 to further skew WOO price.
6. Swap ~7,856,868.8 WOO -> USDCe on WooPPV2 at the manipulated price.
7. Repay Silo WOO debt, withdraw USDCe collateral, repay LBT flash loan plus fees.
8. Keep remaining USDCe/WETH/WOO as profit (~$8M).
**Exploitation:** Attacker flash-borrowed USDCe (Uniswap V3) and WOO (LBT), used Silo to lever up WOO via USDCe collateral, then executed a sequence of WooPPV2 swaps to push the WooracleV2 WOO price, swapping WOO back to USDCe at the inflated rate and repaying loans with profit.
**Escalation:** Leveraged Silo lending to amplify WOO position on top of two flash loans, maximizing drain from WooPPV2.
**Insight:** When a DEX quotes via an on-chain oracle updated by its own pool swaps, a large swap can move the quote within the same tx; check whether oracle state is refreshed from pool balances and whether a flash-loan-funded swap sequence can round-trip at a profit.