# UwULend: sUSDE oracle manipulation enables $19.3M liquidation drain

UwULend oracle priced sUSDE from manipulable Curve pools; attacker flash-loaned, crashed sUSDE price, and liquidated bad-debt positions for ~$19.3M.

- Payout: Real-world hack
- Severity: critical
- Program: UwULend
- Credited: DeFiHackLabs
- Disclosed: 2024-06-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/UwuLend_First_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240610-uwulend-first
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** Lending pool price oracle (sUSDE) and liquidation logic
**Root cause:** The UwULend oracle derived sUSDE price from thin Curve pools that the attacker could skew via large flash-loaned swaps, so collateral/debt valuations were manipulable.
**Steps:**
1. Flash-loan WETH, WBTC, sUSDE, USDE, DAI, USDC, FRAX from Aave, Spark, Morpho Blue, Uniswap V3, Balancer, MakerDAO.
2. Swap heavily through USDe/crvUSD, USDe/DAI, FRAX/USDe, GHO/USDe, USDC/USDe and MtEthena Curve pools to drive down the sUSDE oracle price.
3. Deposit WBTC, DAI, sUSDE into UwULend; disable sUSDE as collateral so only WBTC/DAI back the position.
4. Open a max-LTV sUSDE debt position via helper contract using WETH collateral.
5. With sUSDE price crashed, the position is underwater; liquidate it at the 110% bonus.
6. Repay flash loans and keep the seized collateral as profit (~$19.3M).
**Exploitation:** Attacker flash-loaned large token balances, dumped them into Curve sUSDE-related pools to crash the oracle price, opened a deliberately underwater sUSDE debt position, then liquidated it to seize discounted collateral, netting ~$19.3M.
**Escalation:** Chained multiple flash-loan sources to accumulate enough capital to move thin Curve pools and force a liquidation bonus payout.
**Insight:** When a lending protocol's oracle reads spot prices from Curve/Uniswap pools, check pool depth vs. the protocol's TVL: if a single flash loan can move the pool enough to flip a position underwater, the liquidation bonus is directly extractable.