# Bedrock DeFi: mint() misprices uniBTC 1:1 with ETH

Bedrock DeFi's mint() priced uniBTC 1:1 with ETH instead of BTC, letting an attacker flash-loan WETH, mint cheap uniBTC, and swap for WBTC profit.

- Payout: Real-world hack
- Severity: critical
- Program: Bedrock_DeFi
- Credited: DeFiHackLabs
- Disclosed: 2024-09-26
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-09/Bedrock_DeFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240926-bedrock-defi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** Vulnerable Vault contract mint() function
**Root cause:** The mint() function accepted ETH and issued uniBTC at a 1:1 ratio, ignoring the actual BTC/ETH price difference, allowing arbitrage.
**Steps:**
1. Flash loan 30.8 WETH from Balancer Vault.
2. Withdraw WETH to ETH.
3. Call VulVault.mint{value: 30.8 ETH}() to receive 30.8 uniBTC.
4. Approve UniV3 router to spend uniBTC and WBTC.
5. Swap uniBTC for WBTC via UniV3 exactInputSingle (fee 500).
6. Swap received WBTC for WETH via UniV3 exactInputSingle (fee 500).
7. Repay flash loan and keep remaining WETH as profit.
**How found:** Likely identified by reviewing the mint() function and noticing it issues uniBTC 1:1 for ETH without an oracle or price check, enabling arbitrage against market prices.
**Exploitation:** Attacker flash-loaned 30.8 WETH, converted to ETH, minted 30.8 uniBTC at 1:1, swapped uniBTC to WBTC on Uniswap V3, then WBTC to WETH, repaid loan, and profited from the price discrepancy.
**Insight:** When a protocol mints a pegged asset for a different collateral, always verify the conversion rate uses a reliable oracle; 1:1 assumptions between volatile assets are a common flaw.