# BasePricePool: withdrawGOUT price manipulation drains GOUT via flash loan

BasePricePool.withdrawGOUT mispriced GOUT payouts from manipulable QCD balances, letting a flash-loan attacker redeem cheap QCD for excess GOUT and profit ~$802.

- Payout: Real-world hack
- Severity: medium
- Program: BasePricePool
- Credited: DeFiHackLabs
- Disclosed: 2025-06-19
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/BasePricePool_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250619-basepricepool
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BSC smart contract withdrawGOUT payout pricing
**Root cause:** withdrawGOUT prices the GOUT payout from the post-transfer QCD amount and a circulating QCD denominator derived from manipulable token/pair balances, so redemption value can exceed QCD cost.
**Steps:**
1. Flash-borrow 1,900 USDT from DODO pool `0x6098A5638d8D7e9Ed2f952d35B2b67c34EC6B476`.
2. Swap USDT->QCD on Pancake router `0x10ED43C718714eb63d5aA57B78B54704E256024E` via `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
3. Call `BasePricePool(0x53FeF7d598A2Db0920b2A9fDF27E5C401DC9Ff85).withdrawGOUT(qcdBalance)` with freshly bought QCD.
4. Swap received GOUT->USDT on Pancake router.
5. Repay 1,900 USDT to DODO pool and forward surplus USDT to attacker.
**Exploitation:** Attacker flash-borrowed 1,900 USDT, bought QCD, redeemed it through withdrawGOUT for inflated GOUT, sold GOUT back to USDT, repaid the flash loan, and kept ~$802 surplus.
**Insight:** When a redeem/withdraw function prices payout from the caller's just-transferred token balance and a circulating-supply denominator built from AMM pair balances, buying the input token in the same tx inflates the payout ratio; test single-tx buy->redeem->sell loops against such pools.