# UsualMoney USD0++ VaultRouter pricing arbitrage drains 43k

USD0++/sUSDS Uniswap V3 pool pricing arbitrage via VaultRouter deposit and Curve USD0/USD0++ mispricing drained 43k USD from UsualMoney.

- Payout: Real-world hack
- Severity: high
- Program: UsualMoney
- Credited: DeFiHackLabs
- Disclosed: 2025-05-27
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/UsualMoney_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250527-usualmoney
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** USD0++ VaultRouter / Uniswap V3 USD0-sUSDS pool / Curve USD0-USD0++ pool
**Root cause:** VaultRouter.deposit priced USD0++ deposits using a manipulable Uniswap V3 USD0/sUSDS pool, and the Curve USD0/USD0++ pool was mispriced relative to the manipulated V3 pool, allowing arbitrage.
**Steps:**
1. Flash loan `1899838465685386939269479` USD0++ from Morpho Blue
2. Create/initialize Uniswap V3 USD0/sUSDS pool at price 181769597477799861 and mint tiny liquidity position
3. Call `VaultRouter.deposit(augustus, USD0++, amountIn, 1, 0, this, <ParaSwap calldata>)` to swap USD0++ into USD0/sUSDS via manipulated pool
4. `decreaseLiquidity` and `collect` from tokenId 998318 to extract pool tokens
5. `USD0USD0Pool.exchange(0,1,...)` USD0 -> USD0++ then `exchange(1,0,...)` back to profit from mispricing
6. Swap USD0 -> USDC -> WETH via Uniswap V3 exactInput, withdraw WETH to ETH
**Exploitation:** Attacker flash-borrowed USD0++ from Morpho, deposited into VaultRouter which routed a ParaSwap swap through a freshly created/manipulated Uniswap V3 USD0/sUSDS pool, then arbitraged the mispriced Curve USD0/USD0++ pool and cashed out via USDC/WETH.
**Insight:** Vault deposit routers that price shares via a thin or attacker-creatable Uniswap V3 pool are arbitrageable: check whether the pool used for pricing can be initialized/minted by the attacker in the same tx.