# Sharwa Finance: missing insolvency check in TradeRouter drains funds

Sharwa Finance TradeRouter lacked a post-insolvency check, letting an attacker open a long WBTC position, withdraw collateral, and profit via flash-loan price manipulation.

- Payout: Real-world hack
- Severity: high
- Program: SharwaFinance
- Credited: DeFiHackLabs
- Disclosed: 2025-10-20
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-10/SharwaFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** Arbitrum margin trading TradeRouter / SupplyTokenPool
**Root cause:** TradeRouter's increaseLongPosition/decreaseLongPosition did not verify account solvency after position changes, allowing collateral to be withdrawn while a leveraged position remained open.
**Steps:**
1. Flash loan 40,000 USDC from Morpho via `flashLoan(USDC, 4e10, data)`
2. `createMarginAccount()` to get marginAccountID
3. `pool.provide(FLASHLOAN_USDC)` to deposit USDC into SF-LP-USDC pool
4. `marginTradeRouter.provideERC20(id, USDC, 2.2e9)` to fund margin account
5. `tradeRouter.increaseLongPosition(id, WBTC, 36_200_000)` to open leveraged WBTC long
6. `pool.withdraw(pool.balanceOf(this))` to pull collateral back out despite open position
7. Second tx: flash loan 3,700 WBTC from Morpho
8. Swap WBTC->USDC on Uniswap V3 to move price
9. `tradeRouter.decreaseLongPosition(id, WBTC, 36_199_999)` to close position at manipulated price
10. Swap USDC->WBTC to repay flash loan, keep profit
**Exploitation:** Attacker flash-borrowed USDC to open a leveraged WBTC long via TradeRouter, then withdrew the supplied collateral from the pool while the position stayed open (no insolvency check). In a second tx, a WBTC flash loan plus Uniswap V3 swaps manipulated the WBTC price, and decreaseLongPosition settled the position at the favorable price, extracting ~146k USD.
**Escalation:** Two-transaction sequence across blocks: first tx opens position and withdraws collateral; second tx uses a WBTC flash loan and DEX swaps to manipulate price before closing the position.
**Insight:** When a margin/trading router lets you open a leveraged position and separately withdraw supplied collateral, check whether solvency is re-validated after each action; if not, open a position, pull collateral, then manipulate the DEX price used for settlement to close profitably.