# Sharwa: Hegic option spot-price manipulation inflates collateral

Sharwa valued Hegic option NFT collateral via a manipulable Uniswap V3 spot quote, letting an attacker inflate collateral and borrow 32.85K USDC.

- Payout: Real-world hack
- Severity: high
- Program: SharwaMarginTrading
- Credited: DeFiHackLabs
- Disclosed: 2026-05-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/SharwaMarginTrading_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260501-sharwamargintrading
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Sharwa MarginTradingRouter / MarginAccountManager collateral valuation
**Root cause:** Sharwa priced Hegic option NFT collateral using a Uniswap V3 spot Quoter path (USDC/USDC.e) that is cheaply manipulable, so collateral value could be inflated within a single transaction.
**Steps:**
1. Flash loan 22,000 USDC from Balancer Vault.
2. Swap USDC into the thin USDC/USDC.e Uniswap V3 pool to skew the spot price.
3. Create a Sharwa margin account and deposit Hegic option NFT #16129 via `provideERC721`.
4. Binary-search max borrowable amount per token using a probe that reverts on success, then `borrow` + `withdrawERC20` USDC, WETH, WBTC.
5. Swap borrowed assets and USDC.e back to USDC.
6. Repay Balancer flash loan and forward remaining USDC to attacker.
**How found:** Recognized that Sharwa's collateral valuation relied on a Uniswap V3 spot Quoter path rather than a manipulation-resistant oracle, and that the ERC721 receive callback provided an atomic hook to manipulate the pool before valuation.
**Exploitation:** Attacker transferred the Hegic option NFT to a receiver contract; the ERC721 `onERC721Received` callback triggered a Balancer flash loan of 22K USDC, which was swapped into the USDC/USDC.e pool to inflate the option's quoted value. The inflated option was deposited as collateral, max borrows of USDC/WETH/WBTC were withdrawn via binary search, proceeds swapped back to USDC, flash loan repaid, ~32.85K USDC profit kept.
**Escalation:** Binary-search probing of borrow limits maximized extraction across all three supported assets (USDC, WETH, WBTC).
**Insight:** When a lending protocol prices NFT or option collateral via a DEX spot quoter, check whether the pricing pool is thin and whether an ERC721/ERC1155 receive callback gives an atomic window to skew it before deposit valuation.