# DRLVaultV3: on-chain slippage quote enables price manipulation drain

DRLVaultV3 computed swap slippage minimum from the live manipulable pool quote, letting an attacker inflate WETH price and drain 100k USDT.

- Payout: Real-world hack
- Severity: high
- Program: DRLVaultV3
- Credited: DeFiHackLabs
- Disclosed: 2025-11-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-11/DRLVaultV3_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20251110-drlvaultv3
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** USDC-WETH rebalance vault swapToWETH on Ethereum
**Root cause:** swapToWETH derives amountOutMinimum from getQuoteForUSDC reading the current pool price in the same transaction, so the slippage baseline moves with attacker manipulation, nullifying the 0.5% protection.
**Steps:**
1. Flash loan ~13.98M USDC from Morpho Blue.
2. Swap USDC to WETH via DEX router, spiking WETH price in the USDC/WETH pool.
3. Call `vault.swapToWETH(100000e6)`, vault buys WETH at manipulated price using its own USDC.
4. Sell acquired WETH back into the pool at inflated price.
5. Repay flash loan, keep ~100k USDT profit.
**How found:** Recognized that the vault's amountOutMinimum is computed on-chain from the same pool it trades against, making the slippage reference manipulable within one transaction.
**Exploitation:** Attacker flash-borrowed 14M USDC from Morpho, bought WETH to push pool price up, triggered vault.swapToWETH so the vault bought WETH at the inflated price with its USDC, then sold WETH back into the pool to capture the price difference, repaying the loan.
**Insight:** When auditing vaults, check whether slippage/minOut is derived from the same pool being traded; if so, a flash-loan price push moves both the trade price and the guard, so the guard is worthless.