# Impermax V3: oracle manipulation via Uniswap V3 LP position

Impermax V3 on Base was exploited via flash loan price oracle manipulation of a Uniswap V3 LP position, draining ~$300k.

- Payout: Real-world hack
- Severity: critical
- Program: ImpermaxV3
- Credited: DeFiHackLabs
- Disclosed: 2025-04-26
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/ImpermaxV3_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250426-impermaxv3
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** ImpermaxV3Borrowable contract on Base
**Root cause:** The protocol used the spot price of a Uniswap V3 LP position as collateral value, which could be manipulated by large swaps within a single transaction.
**Steps:**
1. Flash loan 10,544 WETH from Morpho.
2. Flash loan 22,539 USDC from Morpho.
3. Swap USDC to WETH in Uniswap V3 pool 0x1C45... to manipulate price.
4. Mint a new Uniswap V3 LP position with specific tick range and deposit into Impermax V3 Collateral.
5. Perform multiple swaps to further manipulate the pool price and accrue fees.
6. Reinvest the LP position to update its value.
7. Transfer WETH to ImpermaxV3Borrowable and mint shares.
8. Borrow all WETH from ImpermaxV3Borrowable using the inflated LP position as collateral.
9. Reinvest again, restructure bad debt, and redeem the LP position.
10. Swap remaining tokens and redeem Impermax shares to profit.
**How found:** Likely identified that Impermax V3's collateral valuation relied on Uniswap V3 spot price, which is susceptible to flash loan manipulation.
**Exploitation:** Attacker used flash loans to manipulate the Uniswap V3 pool price, inflating the value of a crafted LP position used as collateral on Impermax V3. They then borrowed all available WETH against this inflated collateral, repaid the flash loans, and kept the profit.
**Insight:** When a protocol uses a Uniswap V3 LP position as collateral, check if its value is derived from spot price; if so, it can be manipulated via large swaps within a single transaction.