# Wall Street Memes: flash-loan price manipulation drains presale

Flash-loan price manipulation of the WSM/BNB pool let the attacker buy WSM cheaply via the presale's buyWithBNB(), netting ~$18K.

- Payout: Real-world hack
- Severity: high
- Program: wsm
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-04
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/WSM_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240404-wsm
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** WSM presale contract buyWithBNB() on BSC
**Root cause:** The presale's buyWithBNB() priced WSM using the spot price of a low-liquidity WSM/BNB Uniswap V3 pool, which the attacker could skew with a flash loan.
**Steps:**
1. Flash-borrow 5,000,000 WSM from the WSM/BNB 1% pool via `flash()`.
2. Swap the borrowed WSM for BNB through the 0.3% pool (`exactInputSingle`), crashing the WSM spot price.
3. Withdraw BNB to native and call `buyWithBNB(2_770_000, false)` on the presale proxy, buying WSM at the depressed price.
4. Swap the received BNB back into WSM via `exactInputSingle` to restore price.
5. Repay the flash loan (5,000,000 WSM + fee) and keep the profit.
**Exploitation:** Attacker flash-loaned WSM, dumped it to crash the pool price, used the manipulated spot price to buy WSM cheaply through the presale's buyWithBNB(), then swapped back and repaid the loan, keeping ~2.5e24 WSM (~$18K).
**Insight:** Presale/mint contracts that read a Uniswap V3 spot price (slot0) for their buy rate are directly manipulable by a flash loan against a thin pool; check whether buy functions use pool reserves/spot instead of a TWAP or oracle.