# Nalakuvara LotteryTicket50: price manipulation drains USDC via ticket destruction

Attacker flash-loaned USDC, manipulated Uniswap V2 pair price, then repeatedly called DestructionOfLotteryTickets to drain ~105.5K USDC from Nalakuvara lottery contract.

- Payout: Real-world hack
- Severity: high
- Program: Nalakuvara_LotteryTicket50
- Credited: DeFiHackLabs
- Disclosed: 2025-05-09
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/Nalakuvara_LotteryTicket50_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250509-nalakuvara-lotteryticket50
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** LotteryTicketSwap50 contract on Base
**Root cause:** The DestructionOfLotteryTickets function likely calculates refund based on manipulable Uniswap V2 pair reserves, allowing attacker to inflate ticket value before destruction.
**Steps:**
1. Flash loan 2,930,000 USDC from Uniswap V3 pool `0xd0b53D9277642d899DF5C87A3966A349A798F224`.
2. Transfer 2,800,000 USDC to Uniswap V2 pair `0xaDcaaB077f636d74fd50FDa7f44ad41e20A21FEE` and call `swap(0, 71,500,000e18, attacker, '')` to drain Nalakuvara tokens and manipulate price.
3. Approve LotteryTicketSwap50 to spend USDC, call `transferToken(130,000e6)` to obtain LotteryTicket50 tokens.
4. Transfer 71,500,000e18 Nalakuvara tokens back to Uniswap V2 pair and call `swap(2,908,000e6, 0, attacker, '')` to restore USDC and further manipulate price.
5. Approve LotteryTicketSwap50 to spend LotteryTicket50 tokens.
6. Loop 130 times calling `DestructionOfLotteryTickets(20,000,000)` to redeem tickets for USDC at inflated value.
7. Repay flash loan 2,931,750 USDC to Uniswap V3 pool and transfer profit to attacker.
**Exploitation:** Attacker used a Uniswap V3 flash loan to temporarily manipulate the price of Nalakuvara tokens on a Uniswap V2 pair, then repeatedly destroyed lottery tickets to extract USDC at an inflated rate, netting ~105.5K USDC.
**Insight:** Look for lottery or redemption contracts that calculate refunds based on spot DEX reserves; a flash loan can skew the price and let you redeem at a profit.