# CompoundFork: oracle manipulation via Uniswap pool drains WETH

Compound fork on Base priced uSUI via a manipulable Uniswap V3 pool, letting an attacker inflate collateral and borrow all WETH for ~$1M.

- Payout: Real-world hack
- Severity: critical
- Program: CompoundFork
- Credited: DeFiHackLabs
- Disclosed: 2024-10-26
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-10/CompoundFork_exploit.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241026-compoundfork-exploit
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Compound-fork lending market (cSUI/uSUI) with Uniswap V3 oracle
**Root cause:** The protocol's getUnderlyingPrice derived uSUI value from a thin Uniswap V3 WETH/uSUI pool, so a large swap moved the reported price and inflated collateral value.
**Steps:**
1. Flash loan 800 WETH from Morpho (0xBBBB...FFCb).
2. Call 0xf91d...43D3 with selector `0x38edc837` to enable/enter the market, then mint 15 cWETH and enterMarkets([cSUI]).
3. Borrow all uSUI held by cSUI via `Borrowable(cSUI).borrow(...)`.
4. In Helper, swap 500 WETH -> uSUI on Uniswap V3 router (fee 200) to spike uSUI price.
5. Call `getUnderlyingPrice(cSUI)` to confirm inflated price, then mint 50 cSUI with uSUI collateral.
6. Borrow all WETH from cWETH against inflated collateral.
7. Swap uSUI back to WETH, repay flash loan, keep profit.
**How found:** Not stated; PoC reproduced from on-chain tx analysis (Phalcon/BlockSec).
**Exploitation:** Attacker flash-borrowed 800 WETH, borrowed the market's entire uSUI reserve, used it to pump the uSUI/WETH Uniswap V3 pool, minted cSUI against the inflated uSUI price, then borrowed all WETH from cWETH and unwound the swap to repay the flash loan.
**Escalation:** Chained flash loan + reserve drain + pool price manipulation + collateral mint to borrow the entire WETH reserve in one transaction.
**Insight:** Forked Compound markets that read prices from a single low-liquidity Uniswap V3 pool are manipulable: check whether getUnderlyingPrice uses spot pool state and whether the underlying reserve can be borrowed out to seed the pump.