# VOW: misconfigured token manager enables ~$1M pool drain

VOW token's vscTokenManager allowed converting VOW to vUSD at a fixed rate, enabling an attacker to flash-swap VOW, mint vUSD, and drain VOW/WETH and VOW/USDT pools for ~$1M.

- Payout: Real-world hack
- Severity: high
- Program: VOW
- Credited: DeFiHackLabs
- Disclosed: 2024-08-13
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-08/VOW_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240813-vow
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:misconfiguration vuln:oracle-manipulation

**Target:** VOW token and vscTokenManager contract on Ethereum
**Root cause:** The vscTokenManager contract allowed anyone to deposit VOW and receive vUSD at a fixed rate without proper access control or rate limiting, enabling arbitrage against VOW liquidity pools.
**Steps:**
1. Flash-swap VOW from VOW/WETH Uniswap V2 pair via `swap(vowBalance-1, 0, address(this), hex"00")`.
2. In `uniswapV2Call`, transfer received VOW to attacker, then `transferFrom(attacker, vscTokenManager, amount0)` to mint vUSD.
3. Transfer vUSD from attacker to attack contract, then swap vUSD for VOW on vUSD/VOW pair.
4. Repay VOW/WETH flash loan with fee.
5. Swap remaining VOW for WETH on VOW/WETH pair, withdraw WETH to ETH, send to attacker.
6. Swap remaining VOW for USDT on VOW/USDT pair, transfer USDT to attacker.
**Exploitation:** Attacker used a flash loan from VOW/WETH pair to obtain VOW, deposited it into vscTokenManager to mint vUSD at a favorable rate, swapped vUSD for more VOW on vUSD/VOW pair, repaid the flash loan, then sold remaining VOW for WETH and USDT, netting ~$1M.
**Insight:** Look for token manager or minting contracts that accept a project token and issue a stablecoin or derivative at a fixed rate without access control; such contracts can be used to arbitrage against the token's own liquidity pools.