# Cook Finance: oracle manipulation in issueWithSingleToken2 drains CKToken

Cook Finance issueWithSingleToken2 trusted attacker-supplied weightings and a zero-min-output Pancake spot adapter, letting thin-pool manipulation drain CKToken components for ~$50K.

- Payout: Real-world hack
- Severity: high
- Program: CookFinanceIssuance
- Credited: DeFiHackLabs
- Disclosed: 2026-06-27
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/CookFinanceIssuance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260627-cookfinanceissuance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Cook IssuanceModuleV2 / CKToken issuance via Pancake V2 spot adapter
**Root cause:** issueWithSingleToken2 accepted caller-chosen component weightings and routed CKToken holdings through a Pancake V2 spot-price adapter with zero minimum output, so thin-pool spot prices dictated how much of each component the module sold.
**Steps:**
1. Fork BSC at block 106740999; fund attacker with 0.02 BNB.
2. Read CKToken.getComponents() (8 components).
3. Seed thin Pancake pairs: buy components[0] with 0.001 BNB and 0.0001 BNB, buy others with 0.0001 BNB, addLiquidity with ~10% base and full component balance.
4. Call `issueWithSingleToken2(CK_TOKEN, components[0], 1, 0, midTokens, weightings, this, true)` with weightings[0] = 99.9% of CKToken's components[0] balance * 1e18 and others = 1_000_000e18.
5. removeLiquidity on all seeded pairs to recover base tokens.
6. Repeat seeding with components[1] as base and issue again to drain CKToken's components[1] balance.
7. Swap recovered components to BNB via Pancake router and forward profit.
**How found:** Recognized that issueWithSingleToken2 takes user-supplied weightings and midTokens and swaps through a spot-price adapter with no slippage floor; hypothesized that seeding thin Pancake pools would let the caller dictate the effective price and force the module to sell its own component reserves.
**Exploitation:** Attacker seeded thin Pancake V2 pools for each CKToken component, then called issueWithSingleToken2 twice with manipulated weightings so the module sold ~99.9% of CKToken's component holdings at attacker-controlled spot prices with minCkTokenRec=0, then removed seeded LP and sold recovered components for BNB, netting ~$50K.
**Escalation:** Repeated the same primitive across two different base components (CAKE then vBNB) to drain multiple CKToken component balances in one tx.
**Insight:** When an issuance/redeem function accepts caller-supplied weightings or midTokens and prices via a spot AMM adapter, check whether min-output is enforced; if not, thin-pool seeding lets you steer the module's own reserve sales.