# LAURAToken: pair balance manipulation drains WETH via removeLiquidityWhenKIncreases

LAURA token's removeLiquidityWhenKIncreases lets attacker manipulate the LAURA/WETH pair balance via flash loan to drain 12.34 ETH.

- Payout: Real-world hack
- Severity: high
- Program: LAURAToken
- Credited: DeFiHackLabs
- Disclosed: 2025-01-01
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/LAURAToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250101-lauratoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** ERC20 token with custom removeLiquidityWhenKIncreases hook on UniswapV2 pair
**Root cause:** LAURA's removeLiquidityWhenKIncreases() acts on the pair's LAURA balance without validating caller-controlled state, letting an attacker shrink the pair's LAURA balance and then remove liquidity at a manipulated ratio.
**Steps:**
1. Flash loan 30000 WETH from Balancer Vault
2. `swapExactTokensForTokensSupportingFeeOnTransferTokens(MAGIC_NUMBER, 0, [weth,LAURA], ...)` to acquire LAURA
3. `addLiquidity(LAURA, weth, bal2, MAGIC_NUMBER, ...)` to seed pair
4. Call `LAURA.removeLiquidityWhenKIncreases()` to distort pair LAURA balance
5. Approve and `removeLiquidity(LAURA, weth, bal3, 0, 0, ...)` to pull WETH out
6. Swap remaining LAURA back to WETH, repay Balancer loan, withdraw ETH
**How found:** PoC author identified the custom removeLiquidityWhenKIncreases hook as a state-mutating function callable by anyone, and reasoned that pre-seeding the pair with a MAGIC_NUMBER-sized swap would let the hook drop the pair's LAURA balance enough to skew removeLiquidity output.
**Exploitation:** Attacker flash-borrows 30000 WETH, swaps into LAURA, adds liquidity, triggers removeLiquidityWhenKIncreases to manipulate the pair's LAURA reserve, then removes liquidity to extract WETH, swaps residual LAURA to WETH, repays loan and keeps ~12.34 ETH.
**Insight:** Custom token hooks that mutate AMM pair reserves (like removeLiquidityWhenKIncreases) are prime targets: check whether an attacker can pre-position pair balances so the hook's internal accounting favors them on the subsequent removeLiquidity.