HYDT Protocol Exploit — Spot-Reserve Oracle Lets `initialMint()` Print HYDT at a Manipulated BNB/USD Price

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2024-10-HYDT_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/HYDT_exp.sol.

Vulnerability classes: vuln/oracle/price-manipulation · vuln/oracle/spot-price · vuln/oracle/single-source

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder (the umbrella DeFiHackLabs repo contains many unrelated PoCs that do not whole-compile, so this one was extracted). Full verbose trace: output.txt. Verified vulnerable source: contracts_InitialMintV2.sol and the oracle library contracts_libraries_DataFetcher.sol.

Key info#

TL;DR#

HYDT is a USD-pegged stablecoin. Its InitialMintV2.initialMint() lets anyone send BNB and receive HYDT "at 1 HYDT per USD at current BNB/USD rates". The "current BNB/USD rate" is read with DataFetcher.quote(...), which is just the instantaneous reserve ratio of the PancakeSwap V2 WBNB/USDT pair:

amountB = (amountA * reserveB) / reserveA;   // spot price, no TWAP, no slippage, no manipulation guard

(contracts_libraries_DataFetcher.sol:33-42)

Because that price comes straight from a manipulable pool, an attacker flash-borrows a huge amount of USDT, dumps it into the WBNB/USDT pair to crash the WBNB reserve (making BNB look ~8.6× more expensive), then calls initialMint() with a tiny 11 BNB. The protocol values those 11 BNB at 54,257.9 USD instead of the honest ~6,280 USD, and mints 54,257.9 HYDT to the attacker. The attacker then sells the over-minted HYDT across PancakeSwap V2/V3, unwinds the manipulation, repays the flash loan, and keeps the difference — 5,702.55 USDT.

Background — what HYDT / InitialMintV2 does#

HYDT is the stable unit of the "Hydro Protocol" family on BSC. The relevant pieces:

• HYDT (source) — an ERC20 whose mint() is gated by CALLER_ROLE (mint(...) external override onlyRole(CALLER_ROLE), contracts_HYDT.sol:69-71). The minting contracts hold that role; the attacker never calls mint directly.
• InitialMintV2 (source) — the bootstrap sale contract. Send BNB → it forwards the BNB to the Reserve and mints you HYDT equal to the USD value of the BNB you sent, "1 HYDT = 1 USD." It has a global cap (INITIAL_MINT_LIMIT = 30,000,000) and a per-day cap (DAILY_INITIAL_MINT_LIMIT = 700,000).
• Reserve (source) — receives the BNB and tracks its USD value, again via DataFetcher.quote(...) (contracts_Reserve.sol:63).
• DataFetcher — the shared "oracle." It reads getReserves() of a PancakeSwap V2 pair and returns a pro-rata quote. This is the entire price feed for the mint.

The whole peg model assumes "BNB/USD as told by the WBNB/USDT pool" is trustworthy. It is not — a V2 pool reserve ratio can be moved arbitrarily within a single transaction.

The vulnerable code#

1. The mint prices BNB with a raw spot quote#

function initialMint() external payable {
    require(msg.value > 0, "InitialMint: insufficient BNB amount");
    ...
    // amount = USD value of the deposited BNB, read from the live pool reserves
    uint256 amount = DataFetcher.quote(PANCAKE_FACTORY, msg.value, WBNB, USDT);

    require(INITIAL_MINT_LIMIT >= initialMints.amount + amount, "...");
    require(DAILY_INITIAL_MINT_LIMIT >= dailyInitialMints.amount + amount, "...");
    initialMints.amount      += amount;
    dailyInitialMints.amount += amount;
    SafeETH.safeTransferETH(RESERVE, msg.value);
    HYDT.mint(_msgSender(), amount);   // ⚠️ mints 1 HYDT per "USD" of manipulated valuation

    emit InitialMint(_msgSender(), msg.value, amount, 1 * 1e18);
}

(contracts_InitialMintV2.sol:155-185)

2. quote is a pure reserve ratio — no manipulation resistance#

function quote(address factory, uint256 amountA, address tokenA, address tokenB)
    internal view returns (uint256 amountB)
{
    require(amountA > 0, "DataFetcher: INSUFFICIENT_AMOUNT");
    (uint256 reserveA, uint256 reserveB) = getReserves(factory, tokenA, tokenB);
    amountB = (amountA * reserveB) / reserveA;   // ⚠️ instantaneous spot price
}

(contracts_libraries_DataFetcher.sol:33-42)

getReserves simply calls IPancakePair(pair).getReserves() (contracts_libraries_DataFetcher.sol:21-31), the current reserves — which the attacker controls for the duration of the transaction.

3. The Reserve deposit path repeats the exact same flaw#

uint256 totalReserve = DataFetcher.quote(PANCAKE_FACTORY, totalReserveBNB, WBNB, USDT);
emit In(_msgSender(), msg.value, totalReserveBNB, totalReserve);

(contracts_Reserve.sol:63-65) — this is the In(..., 11e18, 136.34e18, 672509.03e18) event seen in the trace at the moment of the mint.

Root cause — why it was possible#

A PancakeSwap/Uniswap V2 pair's getReserves() returns the instantaneous balances. The marginal price reserveUSDT / reserveWBNB can be pushed to any value within one transaction by trading against the pool — and reverted just as quickly. Using it as the sole, un-averaged price source for minting a "stablecoin" means the attacker, not the market, decides how much HYDT each BNB is worth.

Concretely the design defects that compose into the bug:

1. Spot oracle, no TWAP. DataFetcher.quote is a one-block reserve ratio. There is no time-weighted average, no Chainlink feed, no sanity band. Whatever the pool says right now is taken as gospel.
2. Permissionless mint at attacker-chosen price. initialMint() is open to anyone; the attacker simply manipulates the pool first, then mints in the same transaction.
3. The mint mints amount HYDT for a deposit valued at amount USD — so over-pricing the BNB by 8.6× over-mints HYDT by 8.6×. The over-minted HYDT is real, fungible, and immediately sellable.
4. The caps are denominated in the same manipulated unit. DAILY_INITIAL_MINT_LIMIT = 700,000 USD is computed from the same manipulated amount, so 11 BNB inflated to 54,257 "USD" sails under the cap while actually being only ~6,280 USD of value — the cap never bites.

The attacker's profit is bounded by HYDT/USDT/WBNB liquidity available to dump the over-minted HYDT (hence the relatively modest ~$5.8K despite an 8.6× mispricing), but the mechanism is a textbook single-transaction spot-oracle manipulation.

Preconditions#

• block.timestamp > _initialMints.startTime (initial minting active — true at the fork block).
• The minted "USD" amount stays under INITIAL_MINT_LIMIT and DAILY_INITIAL_MINT_LIMIT. The inflated 54,257.9 "USD" is below the 700,000/day cap, so the mint succeeds.
• The WBNB/USDT V2 pair must be deep enough to swing the price but shallow enough on the WBNB side that 11M USDT meaningfully crashes the WBNB reserve. At the fork block the pair held ~9,922 WBNB and ~5.66M USDT — perfect for this.
• Working capital to manipulate the pool. The attacker used an 11,000,000 USDT flash loan from a PancakeSwap V3 pool (0x92b7…3121), fully repaid intra-transaction (fee 1,100 USDT).

Attack walkthrough (with on-chain numbers from the trace)#

The WBNB/USDT pair 0x16b9…0daE has token0 = USDT, token1 = WBNB, so reserve0 = USDT, reserve1 = WBNB. All figures are taken directly from the getReserves/Sync/Swap/InitialMint events in output.txt.

Price-manipulation math#

Profit accounting (USDT)#

The exact reconciliation is non-trivial because the attacker cycles USDT↔WBNB↔HYDT through three pools, but the trace's begin/end balances are unambiguous: 0 USDT in, 5,702.55 USDT out, with the flash loan fully repaid. The profit is the over-minted HYDT's resale value net of the manipulation round-trip slippage and the 1,100 USDT flash fee.

Diagrams#

Sequence of the attack#

Pool / price state evolution#

The flaw inside initialMint / DataFetcher.quote#

Remediation#

1. Do not price mints from a spot AMM reserve ratio. Replace DataFetcher.quote with a manipulation-resistant oracle: a Chainlink BNB/USD feed (with staleness + deviation checks), or at minimum a Uniswap/Pancake V2 TWAP sampled over a window long enough that single-block manipulation is uneconomic.
2. Sanity-band the price. Reject mints when the AMM-derived BNB price deviates more than a small percentage from a trusted reference, so a flash-loan swing trips a revert instead of a mint.
3. Apply the fix everywhere the same library is used. Reserve.in/withdraw (contracts_Reserve.sol:63,74) and InitialMintV2.getCurrentPrice/initialMint all funnel through DataFetcher.quote/quoteRouted; fixing only one path leaves the protocol exploitable through the others.
4. Denominate caps in a trusted unit. The daily/global mint caps are meant as circuit breakers but are computed from the manipulated valuation, so they never engage. Compute them against the oracle-validated USD value.
5. Consider mint cooldowns / per-tx limits. Even with a better oracle, allowing an unbounded mint in a single transaction concentrates risk; small per-transaction limits blunt any residual mispricing.

How to reproduce#

The PoC was extracted into a standalone Foundry project (the umbrella DeFiHackLabs repo has many unrelated PoCs that fail to whole-compile under forge test):

_shared/run_poc.sh 2024-10-HYDT_exp -vvvvv

• RPC: a BSC archive endpoint is required (fork block 42,985,310). foundry.toml uses https://bsc-mainnet.public.blastapi.io, which serves historical state at that block; the default setup endpoint (bnb.api.onfinality.io/public) rate-limited (HTTP 429) and was swapped out.
• Result: [PASS] testExploit() with the attacker ending with 5,702.55 USDT profit from a zero starting balance.

Expected tail:

Ran 1 test for test/HYDT_exp.sol:ContractTest
  [Begin] Attacker USDT before exploit: 0.000000000000000000
  pancakeV3FlashCallback
  [End] Attacker USDT after exploit: 5702.553132048443050854
[PASS] testExploit() (gas: 3222603)
Suite result: ok. 1 passed; 0 failed; 0 skipped

Reference: TenArmor alert — https://x.com/TenArmorAlert/status/1844241843518951451 ; BlockSec explorer tx 0xa9df1bd97cf6d4d1d58d3adfbdde719e46a1548db724c2e76b4cd4c3222f22b3 (BSC, ~$5.8K).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2024-10-HYDT_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: HYDT_exp.sol.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "HYDT Protocol Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.