# GradientMakerPool: oracle manipulation drains pool via flash loan

GradientMakerPool price oracle manipulation via flash loan, providing and withdrawing liquidity to drain funds, netting ~5k USD.

- Payout: Real-world hack
- Severity: high
- Program: GradientMakerPool
- Credited: DeFiHackLabs
- Disclosed: 2025-06-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/GradientMakerPool_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250623-gradientmakerpool
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** DeFi liquidity pool contract
**Root cause:** The pool's price oracle was manipulable, allowing an attacker to distort the price of GRAY tokens and profit from liquidity provision/withdrawal.
**Steps:**
1. Flash loan 3 ETH from Morpho Blue.
2. Withdraw 1 WETH to ETH.
3. Swap 1 WETH for 1000 GRAY on Uniswap V2.
4. Approve GradientPool to spend GRAY.
5. Call `provideLiquidity` with 0.632 ETH and 950 GRAY.
6. Call `withdrawLiquidity` with 10000 shares.
7. Deposit 4.010899131704627093 ETH back to WETH to repay flash loan.
**Exploitation:** Attacker flash-loaned 3 ETH, swapped 1 ETH for GRAY to manipulate price, provided liquidity at manipulated price, then withdrew shares to extract more value, repaying loan and keeping profit.
**Insight:** Liquidity pools that rely on spot DEX prices for share valuation are vulnerable to flash-loan price manipulation; check if provide/withdraw functions use manipulable oracles.