# Whalebit: Algebra spot-price oracle manipulation drains 824K

Attacker flash-borrowed CES, manipulated Algebra spot-price oracle via repeated deposits/withdrawals in Whalebit staking, draining 824K USD.

- Payout: Real-world hack
- Severity: critical
- Program: WhalebitOracleManipulation
- Credited: DeFiHackLabs
- Disclosed: 2026-03-31
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/WhalebitOracleManipulation_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260331-whalebitoraclemanipulation
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Whalebit staking/levels contract using Algebra pool spot price
**Root cause:** Whalebit's pricer relied on the spot price from a CES/USDT Algebra pool, which could be manipulated by large swaps within a single transaction.
**Steps:**
1. Flash-borrow all CES from the CES/USDT flash pool.
2. For each of 5 helper contracts, transfer `cesAmount` CES and call `deposit(LEVEL)` on Whalebit staking.
3. Swap remaining CES into the Algebra pool to crash the spot price (target price = 45% of current).
4. Call `withdraw()` on each helper to retrieve CES at the manipulated price, receiving more CES than deposited.
5. Swap received USDT back to CES to restore price and accumulate profit.
6. Repeat steps 2-5 for 3 rounds.
7. Repay flash loan plus fee, keeping profit.
**Exploitation:** Attacker used flash loan to obtain large CES, deposited into Whalebit via helpers, manipulated Algebra pool spot price by selling CES, withdrew more CES than deposited due to inflated price, swapped back to restore price, repeated, and repaid loan.
**Escalation:** Repeated the cycle 3 times to amplify profit.
**Insight:** Spot-price oracles from AMM pools are vulnerable to single-transaction manipulation; check if staking/withdrawal logic uses such prices and whether flash loans can amplify the attack.