# SBR Token: Uniswap V2 skim/sync price manipulation exploit

SBR token price manipulated via Uniswap V2 skim/sync to drain ~$18.4K from the pair.

- Payout: Real-world hack
- Severity: high
- Program: SBR Token
- Credited: DeFiHackLabs
- Disclosed: 2025-03-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/SBRToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250307-sbrtoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high vuln:business-logic vuln:oracle-manipulation

**Target:** Uniswap V2 pair for SBR/wETH
**Root cause:** The SBR token's transfer logic or the pair's reserve handling allowed an attacker to manipulate the pair's reserves via skim and sync, creating a massive price imbalance.
**Steps:**
1. Swap tiny amount of wETH for SBR via UniswapV2Router to get SBR tokens.
2. Call `UniswapV2Pair.skim(pair)` to remove excess tokens (likely due to fee-on-transfer or rebase).
3. Transfer 1 wei of SBR to the pair to trigger a state change.
4. Call `UniswapV2Pair.sync()` to force reserves to match balances, drastically lowering SBR reserve.
5. Approve router to spend SBR.
6. Swap all SBR for wETH via `swapExactTokensForETHSupportingFeeOnTransferTokens`, extracting ETH at manipulated price.
**Exploitation:** Attacker used a flash-loan-free approach: bought minimal SBR, then used skim and sync to artificially reduce SBR reserve in the pair, making SBR extremely valuable. Then sold the acquired SBR for a large amount of wETH, draining the pair.
**Insight:** Tokens with fee-on-transfer or rebase mechanics can break Uniswap V2 invariant; calling skim then sync can be used to manipulate reserves if the token's balance can be altered without updating reserves.