# OMPx: flash loan price manipulation drains contract

OMPx contract's purchase/buyBack price logic was manipulated via flash loan, draining 4.37 ETH from the contract.

- Payout: Real-world hack
- Severity: high
- Program: OMPx Contract
- Credited: DeFiHackLabs
- Disclosed: 2024-08-16
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-08/OMPxContract_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240816-ompxcontract
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** OMPx contract (0x09A8...6108) on Ethereum
**Root cause:** The purchase and buyBack functions rely on a manipulable spot price derived from the contract's OMPX balance, allowing an attacker to buy low and sell high within a single transaction.
**Steps:**
1. Flash loan 100 WETH from Balancer Vault.
2. Withdraw WETH to ETH.
3. Loop 7 times: call `purchase{value: 100 ether}(IERC20(OMPX).balanceOf(OMPxContract), 10_000_000_000_000)` to buy OMPX at manipulated low price.
4. Call `buyBack(IERC20(OMPX).balanceOf(address(this)), 1)` to sell OMPX back at manipulated high price.
5. Repeat loop to accumulate profit.
6. Deposit remaining ETH to WETH, repay flash loan plus fee, and withdraw profit.
**Exploitation:** Attacker used a Balancer flash loan of 100 WETH, converted to ETH, then repeatedly called purchase and buyBack on the OMPx contract. By manipulating the contract's OMPX balance, the price for purchases and buybacks was skewed, allowing the attacker to extract ETH from the contract. After 7 iterations, the attacker repaid the flash loan and kept the profit.
**Insight:** Spot price calculations based on contract token balances are vulnerable to flash loan manipulation; always use time-weighted average prices or external oracles.