# Peapods Finance: slippage override in depositFromPairedLpToken drains rewards

Peapods TokenRewards depositFromPairedLpToken let callers set _slippageOverride=999, so an attacker flash-swapped to skew price and drained ~$3,500 via unfavorable swap.

- Payout: Real-world hack
- Severity: medium
- Program: Peapods Finance
- Credited: DeFiHackLabs
- Disclosed: 2025-02-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/PeapodsFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** TokenRewards.depositFromPairedLpToken reward swap on Uniswap V3
**Root cause:** depositFromPairedLpToken accepts a user-supplied _slippageOverride that directly sets amountOutMinimum for the internal exactInputSingle swap, with no bounds or oracle validation.
**Steps:**
1. Flash-borrow 9,420 pOHM from Uniswap V2 pair via `swap(0, 9420000000000000000000, attacker, ...)`.
2. In uniswapV2Call, approve pOHM to Uniswap V3 router and swap pOHM->PEAS at fee 10000 to skew the pool price.
3. Call `TokenRewards.depositFromPairedLpToken(0, 999)` so the contract swaps at amountOutMinimum derived from slippage 999, accepting a terrible rate.
4. Swap received PEAS back to pOHM via V3 router.
5. Repay 9,448 pOHM to the V2 pair and keep the pOHM profit.
**How found:** Analysis notes the function exposes _slippageOverride as a caller-controlled parameter feeding amountOutMinimum, enabling a front-run/sandwich of reward processing.
**Exploitation:** Attacker flash-swapped to manipulate the pOHM/PEAS pool, then invoked depositFromPairedLpToken with _slippageOverride=999 so the reward contract executed its swap at an extreme unfavorable price, then reversed the trade to capture the difference and repaid the flash loan.
**Insight:** Grep reward/treasury contracts for user-supplied slippage or min-out parameters that feed internal DEX swaps; any caller-settable amountOutMinimum is a sandwich primitive against the protocol's own liquidity.