# vETH: spot-price dependency in factory enables 447k drain

vETH factory priced BIF via manipulable spot quote, letting attacker flash-borrow WETH, pump BIF, mint vETH cheaply, and drain ~447k.

- Payout: Real-world hack
- Severity: high
- Program: vETH
- Credited: DeFiHackLabs
- Disclosed: 2024-11-14
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-11/vETH_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241114-veth
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** vETH factory / DEX quote interface on Ethereum mainnet
**Root cause:** The vulnerable factory (0x62f2...a1b5) relied on a manipulable spot price/quote from the DEX interface to value BIF when minting vETH, instead of a manipulation-resistant oracle.
**Steps:**
1. Flash-borrow ~32,560 WETH from Balancer Vault via `flashLoan`.
2. `WETH.withdraw` to ETH, then call `DEX_INTERFACE.buyQuote(BIF, borrowed_eth, 0)` to buy BIF, pumping BIF spot price.
3. `BIF.approve(VULN_FACTORY, bif_balance)` and call factory selector `0x6c0472da(vETH, BIF, 300 ether, 0,0,0)` to mint vETH against inflated BIF valuation.
4. Sell remaining BIF via `DEX_INTERFACE.sellQuote(BIF, 6378941079150051291618297, 0)`.
5. `WETH.deposit` and repay Balancer flash loan; keep profit.
**Exploitation:** Attacker flash-borrowed all WETH from Balancer, swapped into BIF to inflate its spot price, then called the vulnerable factory to mint vETH at the manipulated BIF valuation, sold BIF back, and repaid the loan, netting ~447k.
**Escalation:** Repeated across three attack txs (vETH-BIF, vETH-Cowbo, vETH-BOVIN) against multiple pools.
**Insight:** When a mint/redeem path calls a DEX quote interface for valuation, the same block's swap can move that quote; check whether the factory reads spot reserves rather than a TWAP or external oracle.