# LavaLending: LP price manipulation via flash-loan oracle skew

LavaLending's WETHUSDC LP oracle was manipulated via nested flash loans to inflate collateral value, letting attacker borrow and drain ~$130K.

- Payout: Real-world hack
- Severity: high
- Program: LavaLending
- Credited: DeFiHackLabs
- Disclosed: 2024-10-02
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/LavaLending_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241002-lavalending
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Lending pool with WETHUSDC LP collateral and Aave-style oracle
**Root cause:** The lending pool priced its WETHUSDC LP collateral from a manipulable on-chain source (Algebra/Uniswap pool spot), so a large flash-loan-driven swap skewed the LP's reported value.
**Steps:**
1. Flash-borrow USDC from AlgebraPool via `flash()`.
2. Nested flash loans from Aave V3, Balancer SwapFlashLoan, and Balancer Vault to accumulate large USDC/WETH capital.
3. Deposit into WETHUSDC_LP (`deposit(startKey, assetType, vaultId, quantizedAmount)`) to mint LP tokens.
4. Deposit LP into LendingPool as collateral; oracle reads inflated LP price.
5. Borrow against inflated collateral (cUSDC, WBTC, WETH) via secondary AttackerC2 contract.
6. Withdraw LP, compound, re-deposit, swap on UniswapV3Pool to unwind, repay flash loans, keep profit.
**How found:** Likely identified that LavaLending's LP collateral price derived from a spot AMM pool (Algebra/Uniswap) rather than a TWAP, making it flash-loan manipulable.
**Exploitation:** Attacker stacked four flash loans (Algebra, Aave V3, Balancer SwapFlashLoan, Balancer Vault) to amass USDC, minted WETHUSDC LP, deposited as collateral, then borrowed against the manipulated LP valuation and unwound positions, netting ~$130K in USDC/cUSDC/WBTC/WETH.
**Escalation:** Chained multiple lending protocols' flash loans to bypass single-source liquidity limits and amplify the oracle skew.
**Insight:** When a lending market accepts LP tokens as collateral, check whether the LP's underlying value is read from a spot pool; if so, a single large swap inside a flash loan can inflate collateral and enable over-borrowing.