# RoulettePotV2: flash-loan price manipulation drains pot

RoulettePotV2 on BSC was drained of ~28K via flash-loan price manipulation of its finishRound and swapProfitFees functions.

- Payout: Real-world hack
- Severity: high
- Program: RoulettePotV2
- Credited: DeFiHackLabs
- Disclosed: 2025-01-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/RoulettePotV2_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250111-roulettepotv2
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC smart contract (RoulettePotV2) and PancakeSwap pools
**Root cause:** The contract's finishRound and swapProfitFees functions rely on manipulable spot prices from PancakeSwap pools, allowing an attacker to distort token values and extract funds.
**Steps:**
1. Flash loan 4,203.73 WBNB from PancakeV3Pool `0x172fcD41E0913e95784454622d1c3724f546f849`.
2. In callback, swap 17,527.79 LINK from PancakeSwap pair `0x824eb9faDFb377394430d2744fa7C42916DE3eCe` to manipulate price.
3. Call `finishRound()` on RoulettePotV2 `0xf573748637E0576387289f1914627d716927F90f`.
4. Call `swapProfitFees()` on RoulettePotV2.
5. Transfer all LINK balance back to PancakeSwap pair.
6. Swap 4,243.67 WBNB from PancakeSwap pair to repay flash loan plus fee.
**Exploitation:** Attacker used a flash loan to manipulate the LINK/WBNB price on PancakeSwap, then called finishRound and swapProfitFees to extract value, repaying the loan and keeping ~28K profit.
**Insight:** Functions that compute payouts or swap fees using spot prices from AMM pools are vulnerable to flash-loan manipulation; check for reliance on instantaneous reserves.