# Arrakis G-UNI vault: spot-price manipulation drains mint/burn

Arrakis V1 G-UNI vault priced mint/burn off Uniswap V3 instantaneous spot; attacker skewed the tick, minted cheap shares, restored, burned for ~2.94 ETH profit.

- Payout: Real-world hack
- Severity: high
- Program: ArrakisGUNI
- Credited: DeFiHackLabs
- Disclosed: 2026-08-23
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/ArrakisGUNI_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260823-arrakisguni
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Arrakis V1 G-UNI ENS/WETH vault (Uniswap V3 LP vault)
**Root cause:** Vault's getUnderlyingBalances for permissionless mint()/burn() values the Uniswap V3 position using the pool's instantaneous slot0() sqrtPriceX96; the TWAP/deviation guard only wraps the manager rebalance() path, leaving mint/burn unguarded.
**Steps:**
1. Flash loan 1,800 WETH from Morpho Blue.
2. Swap 150 WETH -> ENS on the V3 pool down to MIN_SQRT_RATIO+1 to skew the tick (~145.42 WETH in, ~13,292.5 ENS out).
3. Call `vault.mint(4486619135659964587643, this)` depositing ~1,253.39 WETH + ~13,159.59 ENS at the skewed spot valuation.
4. Swap ~132.93 ENS -> WETH to partially restore the tick.
5. Call `vault.burn(same shares, this)` to redeem ~1,248.41 WETH + ~13,283.30 ENS (ENS-richer mix).
6. Swap all ENS back to WETH and repay the 1,800 WETH flash loan; ~2.9414 WETH surplus remains.
**How found:** Code reading of ArrakisVaultV1: noticed the TWAP/deviation guard only wraps manager rebalance(), while mint()/burn() call getUnderlyingBalances -> LiquidityAmounts on live slot0() sqrtPriceX96, making the permissionless deposit/withdraw path manipulable by a single swap.
**Exploitation:** Single flash-loan-funded tx: borrow 1,800 WETH, dump 150 WETH into the ENS/WETH V3 pool to push the tick to the min bound, mint vault shares at the distorted valuation, partially restore the tick, burn the shares for a richer ENS mix, then sell ENS back to WETH and repay. Net ~2.9414 WETH surplus forwarded to attacker EOA.
**Insight:** When auditing LP vaults, check whether the TWAP/deviation guard covers only the privileged rebalance path while permissionless mint/burn still read slot0() directly — a single swap to the price bound then mint+burn is enough to extract value.