# StackMarket: flash-loan-driven account token buy/unwind profit

StackMarket's buy path allowed flash-loan-driven purchase of an account token, then unwound via Uniswap V3 for profit, netting 0.56 WETH.

- Payout: Real-world hack
- Severity: medium
- Program: StackMarket
- Credited: DeFiHackLabs
- Disclosed: 2025-03-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/StackMarket_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250307-stackmarket
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** StackMarket buy function and Uniswap V3 pool
**Root cause:** The buy/liquidity path for an account token could be driven by a flash loan and unwound through the corresponding Uniswap V3 pool at a profit, indicating a pricing or liquidity logic flaw.
**Steps:**
1. Flash loan 26.88 WETH from Morpho Blue.
2. Withdraw WETH to ETH and call `StackMarket.buy{value: assets}(account, 1, 0)` to acquire the account token.
3. Approve BaseSwap router and swap all account tokens back to WETH via `exactInputSingle` with fee 500.
4. Repay Morpho flash loan and transfer residual WETH to attacker.
**Exploitation:** Attacker flash-borrowed 26.88 WETH from Morpho, converted to ETH, bought a StackMarket account token, swapped it back to WETH on Uniswap V3, repaid the loan, and kept 0.56 WETH profit.
**Insight:** When a protocol mints/buys a token via a payable function and a corresponding AMM pool exists, test whether a flash loan can buy then immediately sell into that pool for profit—check for mispriced bonding curves or liquidity assumptions.