# Pool can be drained

WooFi swap pool still drainable via oracle price manipulation using tokens lacking Chainlink feeds, repeating the prior exploit pattern.

- Payout: Contest reward
- Severity: high
- Program: Woofi Swap
- Credited: mstpr-brainbot
- Disclosed: 2024-03-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-03-woofi-swap-judging/issues/68
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-woofi-swap%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** WooPPV2 swap pool / Wooracle price oracle
**Root cause:** maxNotionalSwap and maxGamma caps plus the new AMM math do not prevent cumulative price manipulation across partial swaps; tokens without a Chainlink feed fall back to manipulable internal oracle price.
**Steps:**
1. Flashloan ~99,990 WOO.
2. Split the sell into 10 partial swaps of ~9,999 WOO each via `router.swap(WOO, USDC, wooAmountForTapir, 0, ...)` to stay under maxGamma/maxNotionalSwap.
3. Cumulatively crash the WOO oracle price.
4. Sell only 20 USDC back into the pool via `router.swap(USDC, WOO, 20e6, 0, ...)` receiving ~199,779 WOO.
5. Repay flashloan and pocket ~100K WOO profit.
**How found:** Researcher recognized the same attack vector as the prior WooFi SPMM exploit and tested whether the new caps and math actually prevented it, using a coded PoC with partial swaps.
**Exploitation:** Attacker flashloans WOO, performs 10 partial sells to bypass per-swap caps and skew the oracle price, then buys WOO back cheaply with a tiny USDC amount, repaying the loan and keeping the difference.
**Escalation:** Splitting the swap into 10 pieces bypasses maxGamma/maxNotionalSwap limits, making the drain more profitable than a single swap.
**Insight:** Per-swap notional caps don't stop oracle manipulation if the same tx can loop multiple swaps; check whether cumulative price impact across a loop is bounded, especially for tokens lacking an external price feed.