# EmptySetReserve: stale fixed order drains COMP inventory

EmptySetReserve's stale COMP/ESS fixed order let an attacker buy COMP below market via swap() and sell it for ETH profit.

- Payout: Real-world hack
- Severity: medium
- Program: EmptySetReserve
- Credited: DeFiHackLabs
- Disclosed: 2025-07-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/EmptySetReserve_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250724-emptysetreserve
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:recon vuln:business-logic vuln:oracle-manipulation

**Target:** On-chain reserve swap() fixed maker/taker order (COMP/ESS)
**Root cause:** The reserve exposed a stale, favorable fixed COMP/ESS order price via swap(), so any public caller could buy the reserve's COMP inventory below market value.
**Steps:**
1. Flash-borrow 10,000 USDC via Uniswap v4 PoolManager `unlock`/`take`
2. Wrap USDC into DSU via TwoWayBatcher `wrap`
3. Swap DSU->ESS on Uniswap V2, USDC->WETH on V2, WETH->ESS on V3 to accumulate ESS
4. Call `RESERVE.swap(COMP, ESS, RESERVE_ESS_IN)` to buy COMP at the stale fixed order price
5. Sell acquired COMP for WETH/USDC on Uniswap V2
6. Repay flash USDC via `sync`/`settle`, withdraw WETH to ETH, send profit to attacker EOA
**How found:** Attacker (or analyst) observed the reserve's `order(COMP, ESS)` returned a fixed price/amount favorable versus market, making the spread arbitrageable by any public caller.
**Exploitation:** Attacker flash-sourced USDC via Uniswap v4 flash accounting, converted to ESS through DEX routes, then exercised the reserve's stale COMP/ESS order to buy COMP cheap, dumped COMP on Uniswap V2 for WETH, repaid the flash loan, and netted ~0.416 ETH (~$1,509.78).
**Insight:** Monitor on-chain reserve/AMM `order()`/quote functions for fixed prices that drift from market; a stale maker order is directly arbitrageable by anyone who can source the taker token, so check quote vs DEX spot for spread.