# HYDT: oracle price manipulation via WBNB-USDT pair mints cheap tokens

HYDT MintV2 used WBNB-USDT pair price to mint tokens; attacker flash-loaned USDT, swapped to WBNB, minted HYDT cheaply, dumped for profit.

- Payout: Real-world hack
- Severity: high
- Program: HYDT
- Credited: DeFiHackLabs
- Disclosed: 2024-10-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/HYDT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241010-hydt
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** MintV2 contract and PancakeSwap V3 pool
**Root cause:** MintV2 contract calculates mint price using the WBNB-USDT pair reserves, which can be manipulated via large swaps.
**Steps:**
1. Flash loan 11,000,000 USDT from PancakeSwap V3 pool `0x92b7807bF19b7DDdf89b706143896d05228f3121`.
2. Swap USDT to WBNB via PancakeSwap V2 router, manipulating WBNB-USDT pair price.
3. Withdraw 11 WBNB to BNB and call `initialMint()` on MintV2 `0xA2268Fcc2FE7A2Bb755FbE5A7B3Ac346ddFeDB9B` with 11 BNB to mint HYDT at manipulated price.
4. Swap minted HYDT to USDT via PancakeSwap V3 and V2 routers.
5. Repay flash loan and keep profit.
**How found:** Likely identified that MintV2's mint price relies on a manipulable DEX pair, then tested with a flash loan to distort the price.
**Exploitation:** Attacker flash-loaned 11M USDT, swapped to WBNB to manipulate the WBNB-USDT pair price, then used 11 BNB to mint HYDT at a favorable rate, and sold HYDT for USDT, netting ~5.8k USDT profit.
**Insight:** When a contract uses DEX pair reserves as a price oracle, a flash loan can manipulate the reserves to mint tokens cheaply; check if minting logic reads spot prices from AMMs.