# Scorch: oracle manipulation in scorch() drains ETH rewards

Scorch's scorch() priced ETH payouts off a manipulable Uniswap OTC/WETH quote, letting an attacker inflate the quote and drain 0.14 ETH.

- Payout: Real-world hack
- Severity: medium
- Program: Scorch
- Credited: DeFiHackLabs
- Disclosed: 2025-02-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/Scorch_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250211-scorch
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Solidity token contract with Uniswap V2 spot-price oracle
**Root cause:** scorch() computed ETH rewards from a live Uniswap getAmountsOut() spot quote on a thin OTC/WETH pool, which is trivially manipulable via a swap.
**Steps:**
1. Flash-borrow 4 WETH from Uniswap V3 pool `0xE0554a...`
2. Swap 4 WETH -> OTC via Uniswap V2 router to inflate OTC price
3. Loop 8x: compute `burnAmount = router.getAmountsIn(0.097 ether, [OTC,WETH])` and call `scorch(burnAmount)` to drain ETH at inflated quote
4. Sell remaining OTC back to WETH via router
5. Wrap ETH to WETH and repay flash loan + fee
**How found:** Recognized that scorch() used a live Uniswap getAmountsOut() spot quote as its payout oracle, a classic manipulable-price pattern on a low-liquidity pool.
**Exploitation:** Attacker flash-loaned 4 WETH, bought OTC to pump the OTC/WETH pool price, then repeatedly called scorch() which paid out ETH based on the inflated getAmountsOut quote, draining ~0.14 ETH from the contract, then sold remaining OTC and repaid the loan.
**Insight:** Any contract paying out based on a Uniswap V2 getAmountsOut() spot quote on a thin pool is flash-loan manipulable; check reward/burn functions that read router quotes directly rather than a TWAP.