# Will: expired-order settlement price manipulation drains $52K

Will trading contract's expired-order settlement let attacker place a sell order, dump tokens to crash price, then settle at manipulated rate for ~$52K profit.

- Payout: Real-world hack
- Severity: high
- Program: Will
- Analysis by: DeFiHackLabs
- Disclosed: 2024-06-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/Will_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240628-will
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** BSC trading/settlement contract (placeSellOrder, updateExpiredOrders, settleExpiredPositions)
**Root cause:** Settlement of expired sell orders uses a spot/manipulable price rather than a protected oracle or TWAP, so an attacker can move the token price between order placement and settlement.
**Steps:**
1. Fork BSC at block 39979796; fund attacker with 180,000 USDT.
2. `USDT.approve(trading, max)` then `trading.placeSellOrder(71000e18, 0, 0)` to open a sell order.
3. Swap 88,000 USDT into `will` token via PancakeSwap router to depress the will price.
4. `vm.warp(block.timestamp + 20)` to expire the order, then `trading.updateExpiredOrders()` and `trading.settleExpiredPositions(0)`.
5. Swap received `will` tokens back to USDT for profit.
**Exploitation:** Attacker placed a large sell order, then dumped USDT into the will/USDT pool to crash the will price, waited for the order to expire, triggered updateExpiredOrders and settleExpiredPositions so the position settled at the manipulated low price, then swapped the acquired will tokens back to USDT, netting ~$52K across two transactions.
**Insight:** When a protocol settles expired orders/positions against a live AMM pool price, check whether you can place an order, move the pool, then trigger settlement in the same or adjacent block to capture the price delta.