# MineSTM: business logic flaw in sell allows price manipulation

MineSTM's sell function had a business logic flaw allowing an attacker to manipulate token price via flash loan and drain $13.8K.

- Payout: Real-world hack
- Severity: high
- Program: MineSTM
- Credited: DeFiHackLabs
- Disclosed: 2024-06-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/MineSTM_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240606-minestm
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high vuln:business-logic vuln:oracle-manipulation

**Target:** MineSTM token contract on BSC
**Root cause:** The sell function likely calculates token price based on manipulable state (e.g., allowance or reserves) without proper safeguards, allowing an attacker to profit from price discrepancies.
**Steps:**
1. Flash loan 50,000 BUSDT from BUSDT/USDC PancakeV3 pair.
2. Call BUSDT_STM.sync() to update reserves.
3. Approve router and swap BUSDT for STM via PancakeSwap router.
4. Approve MineSTM contract to spend STM.
5. Call mineSTM.updateAllowance() to update internal allowance state.
6. Call mineSTM.sell(81) and mineSTM.sell(7) to sell STM at manipulated price.
7. Repay flash loan and keep profit.
**Exploitation:** Attacker used a flash loan to buy STM, manipulated the contract's internal state via updateAllowance, then sold STM at an inflated price, extracting $13.8K.
**Insight:** Business logic flaws in token contracts often involve functions that update internal accounting (like allowances) without validating against market prices; look for functions callable by anyone that affect sell/buy calculations.