# PerpPair: virtual AMM manipulation drains collateral vault

PerpPair's virtual AMM was manipulated via flash-loaned liquidity and oversized longs, letting attacker realize inflated PnL and drain 165K USDC from vault.

- Payout: Real-world hack
- Severity: high
- Program: PerpPair
- Credited: DeFiHackLabs
- Disclosed: 2026-04-05
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/PerpPair_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260405-perppair
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** PerpPair virtual AMM and collateral vault on Linea
**Root cause:** Virtual AMM price/PnL calculation can be skewed by large trades from fresh LP positions, allowing inflated PnL realization without sufficient market movement.
**Steps:**
1. Flash loan 60,000 USDC from Aave V3.
2. Deploy LP helper and trader helper; fund with 30,000 and 15,000 USDC.
3. LP helper adds 20,000 virtual stable liquidity via `addLiquidity(20000e18,0,0,"")`.
4. Trader helper opens 100,000 size long via `trade(true,100000e18,0,0,address(0),10,"")`.
5. LP helper calls `realizePnL("")` to get inflated positive PnL, then `removeCollateral(pnl,"")` to withdraw from vault.
6. Repeat with second LP/trader pair (10,000/5,000 USDC, 8,000 liquidity, 30,000 long) to drain remaining collateral.
7. Repay Aave flash loan plus 30 USDC premium; transfer profit to attacker.
**Exploitation:** Attacker used Aave flash loan to fund two LP/trader helper pairs. Each LP added liquidity, trader opened oversized long to skew virtual AMM, then LP realized inflated PnL and withdrew collateral from vault. Repeated to drain 165K USDC.
**Escalation:** Chained two rounds to maximize extraction as vault collateral depleted.
**Insight:** Virtual AMMs that compute LP PnL from internal pricing without external oracle checks are vulnerable to manipulation via large trades from freshly added liquidity; test with flash-loaned capital and multiple rounds to drain collateral.