TiFi Finance Exploit — Spot-Price Oracle Manipulation of a Lending Pool

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2022-12-TIFI_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/TIFI_exp.sol.

Vulnerability classes: vuln/oracle/spot-price · vuln/governance/flash-loan-attack

One-line summary: TiFi's LendingPool priced collateral with a live PancakeSwap spot reserve ratio (GetPrice.getTokenToBNBPrice), so an attacker flash-borrowed WBNB, dumped it into the thin WBNB/BUSD pool to inflate BUSD's BNB price ~77×, deposited 500 BUSD as now-overvalued collateral, and borrowed the entire TiFi token reserve of the pool — netting ~87.14 WBNB.

Reproduction: the PoC compiles & runs in this isolated Foundry project (project folder). Full verbose trace: output.txt. Verified vulnerable source: LendingPool.sol.

Key info#

References: PeckShield tweet · PoC: test/TIFI_exp.sol

TL;DR#

LendingPool values every user's collateral and debt with getPriceWBNB(), which for any non-WBNB token calls GetPrice.getTokenToBNBPrice(token). That helper returns the instantaneous reserve ratio of the token's PancakeSwap pair against WBNB — a pure spot price with no TWAP, no staleness check, and no manipulation guard (LendingPool.sol:1423-1426).

The BUSD price feed pool the protocol read from (0x76Fc4931…) was tiny: about 0.64 WBNB / 186 BUSD. The attacker, inside a single PancakeSwap flash-swap callback:

1. Deposited 500 BUSD into the BUSD pool, receiving ~479 share-tokens of collateral.
2. Dumped 5 WBNB into the thin WBNB/BUSD oracle pool, pushing the implied BUSD→BNB price from ~0.00343 up to ~0.254 BNB/BUSD — a ~77× inflation.
3. Borrowed the entire TIFI balance of the lending pool (≈ 5.2957e11 TIFI). The isAccountHealthy() check now valued the 500 BUSD collateral at ~108 BNB instead of its honest ~1.46 BNB, so the over-collateralization check passed.
4. Sold the borrowed TIFI for 94.14 WBNB, repaid the 7 WBNB flash-swap, and walked away with 87.14 WBNB.

The loan was never repaid; the TIFI it left behind in the pool was effectively worthless once dumped.

Background — what TiFi Finance is#

TiFi Finance is an Aave-style money market on BSC. Each ERC-20 has its own pool. Users deposit() liquidity (minting a TiFiPoolShare receipt token), may use that liquidity as collateral, and borrow() any asset across pools as long as their account stays healthy — i.e. total borrow value ≤ total collateral value. Both values are denominated in BNB and computed by walking every pool the user touches and multiplying balances by a per-token BNB price (getUserAccount, isAccountHealthy).

The price of each token is supplied by an external GetPrice contract (0x9D1FC5…) whose getTokenToBNBPrice(token) reads the token's PancakeSwap reserves and returns reserveWBNB / reserveToken — a raw spot price. There is no TWAP, no Chainlink reference, and no sanity bound.

On-chain values at the fork block (read from the trace):

The vulnerable code#

1. The spot-price oracle (no TWAP, no guard)#

// LendingPool.sol
// Get the price of a token based on WBNB
function getPriceWBNB(address _token) internal view returns (uint256) {
    return _token == getPrice.WBNB() ? 1e18 : getPrice.getTokenToBNBPrice(_token);
}

LendingPool.sol:1423-1426

getPrice.getTokenToBNBPrice (in the external GetPrice contract, interface at LendingPool.sol:7-10) returns the instantaneous PancakeSwap reserve ratio — exactly the value an AMM swap can move within the same transaction.

2. The health check that trusts that price#

function getUserAccount(address _user) public view returns ( ... ) {
    for (uint256 i = 0; i < tokenList.length; i++) {
        ...
        uint256 poolPricePerUnit = getPriceWBNB(address(_token));      // ← manipulable spot price
        require(poolPricePerUnit > 0, "TIFI: PRICE_INVALID");
        uint256 liquidityBalanceBase = (poolPricePerUnit * compoundedLiquidityBalance) / 1e18;
        totalLiquidityBalanceBase += liquidityBalanceBase;
        if (collateralPercent > 0 && userUsePoolAsCollateral) {
            totalCollateralBalanceBase += (liquidityBalanceBase * collateralPercent) / 1e18;
        }
        totalBorrowBalanceBase += (poolPricePerUnit * compoundedBorrowBalance) / 1e18;
    }
}

function isAccountHealthy(address _user) public view override returns (bool) {
    (, uint256 totalCollateralBalanceBase, uint256 totalBorrowBalanceBase) = getUserAccount(_user);
    return totalBorrowBalanceBase <= totalCollateralBalanceBase;   // ← the only solvency gate
}

LendingPool.sol:1783-1836

3. borrow() enforces health after sending tokens, using that same price#

function borrow(ERC20 _token, uint256 _amount)
    external nonReentrant updatePoolWithInterestsAndTimestamp(_token)
{
    ...
    // 4. transfer borrowed token from pool to user
    _token.safeTransfer(msg.sender, _amount);

    // 5. check account health -- reverts if not healthy
    require(isAccountHealthy(msg.sender), "TIFI: ACCOUNT_UNHEALTHY");
    emit Borrow(address(_token), msg.sender, borrowShare, _amount);
}

LendingPool.sol:1888-1917

borrow() happily lets you take up to the pool's entire available liquidity (_amount <= getTotalAvailableLiquidity(_token)), provided the post-borrow health check passes — and that check is reading a price the borrower just rigged.

Root cause — why it was possible#

The solvency invariant borrowValue ≤ collateralValue is enforced against a price that the borrower can move at will, atomically, with capital they don't even need to own (a flash swap).

A constant-product AMM's spot reserve ratio is not a price oracle — it is a number that any swap mutates. Using it directly to value collateral means:

• Collateral inflation: pumping the collateral token's AMM price up (or, here, pumping WBNB into the WBNB/BUSD pool to make BUSD look expensive in BNB terms) inflates totalCollateralBalanceBase.
• No cost to the attacker: the price move and the borrow happen in one transaction, and the WBNB used to move the price is itself flash-borrowed and repaid at the end.
• Thin pool = cheap manipulation: the chosen feed pool held only ~0.64 WBNB and ~186 BUSD, so 5 WBNB was enough for a ~77× swing. There was no requirement that the price source be deep or liquid.

Contributing design decisions:

1. Spot price, no TWAP / external reference. getTokenToBNBPrice returns reserveOut/reserveIn with no time-weighting and no Chainlink cross-check.
2. No staleness / deviation bound. A 77× single-block move triggered no circuit breaker.
3. borrow() allows draining 100% of pool liquidity in one call, so a single inflated health check is enough to empty the pool.
4. Same manipulable price feed values both collateral and debt, but the attacker only needs the collateral side over-valued and the borrowed asset under-counted — both achievable by choosing which pool to pump.

Preconditions#

• The lending pool is ACTIVE and holds a meaningful balance of the asset to be borrowed (TIFI pool held ≈ 5.2957e11 TIFI).
• The collateral token (BUSD) is enabled as collateral with collateralPercent > 0 (85%).
• The GetPrice feed for the collateral token reads a manipulable, shallow PancakeSwap pool (0x76Fc4931…: ~0.64 WBNB / 186 BUSD).
• Access to flash liquidity in WBNB/BUSD — supplied here by a PancakeSwap flash swap on pool 0x58F876… (the data argument to swap() triggers the pancakeCall callback). No own capital required.

Step-by-step attack walkthrough#

The whole exploit happens inside one pancakeCall callback initiated by a flash swap. Token0/token1 of the oracle pool are WBNB/BUSD (because 0xbb4c… < 0xe9e7…).

The BUSD position remains "collateral" backing a now-defaulted TIFI loan; the protocol is left holding worthless borrowed-out TIFI exposure and missing its WBNB-denominated liquidity.

Profit / loss accounting (WBNB)#

The flash swap also moved 500 BUSD in and 5 WBNB in (net of the 5 WBNB and 500 BUSD initially received), all of which nets out in the 7-WBNB repayment. The attacker started and ended with 0 WBNB of own capital, making this a pure flash-funded extraction.

Diagrams#

Sequence of the attack#

Collateral valuation: honest vs. manipulated price#

The flaw inside the health check#

Remediation#

1. Do not use raw AMM spot prices for solvency. Replace getTokenToBNBPrice with a manipulation-resistant oracle: Chainlink price feeds (with staleness + deviation checks) as the primary source, optionally cross-checked against a long-window Uniswap/PancakeSwap TWAP. Never read instantaneous getReserves() ratios for collateral/debt valuation.
2. Add staleness and deviation bounds. Reject prices older than a max age and reject single-update moves larger than a sane percentage band, so a 77× one-block swing can never be accepted.
3. Require deep, sanctioned price pools. If an on-chain DEX must be used, restrict it to high-liquidity, protocol-vetted pairs and require a minimum reserve depth — the BUSD feed pool here was trivially thin.
4. Bound per-call borrow size. Even with a good oracle, allowing a single borrow() to drain 100% of a pool's liquidity magnifies any pricing error; consider utilization caps and per-tx borrow limits.
5. Re-validate health against price snapshots taken before the borrowing transaction's own state changes, and consider checks-effects-interactions ordering so external-call-driven price moves cannot retroactively satisfy the health invariant.

How to reproduce#

The PoC was extracted into a standalone Foundry project (the umbrella DeFiHackLabs repo has many unrelated PoCs that fail to compile together).

_shared/run_poc.sh 2022-12-TIFI_exp --mt testExploit -vvvvv

• RPC: a BSC archive endpoint is required (fork block 23,778,726, Dec 2022). Most public BSC RPCs prune this far back and fail with header not found / missing trie node.
• Result: [PASS] testExploit(); the test logs the attacker's final WBNB balance.

Expected tail (see output.txt:1566-1820):

Ran 1 test for test/TIFI_exp.sol:ContractTest
[PASS] testExploit() (gas: 948610)
  [End] Attacker WBNB balance after exploit: 87.138130026273038368
Suite result: ok. 1 passed; 0 failed; 0 skipped

Reference: PeckShield — https://twitter.com/peckshield/status/1601492605535399936 (TiFi Finance, BSC, Dec 2022).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2022-12-TIFI_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: TIFI_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "TiFi Finance Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.