Vee Finance

Vee Finance's leveraged-trading vault on Avalanche routed swap execution through Pangolin (Uniswap-V2 fork) pairs and computed the trade's expected output / slippage check against the Pangolin pair's spot reserves. The attacker selected illiquid pairs (e.g. WBTC.e/USDT.e, WETH.e/USDT.e on Pangolin where Vee's slippage logic accepted any execution that satisfied a permissive reserve-based check), then for each position opened a leveraged long where the AMM swap step priced the asset based on manipulated reserves — by pre-trading into the same Pangolin pair within the same transaction, the attacker forced Vee's vault to swap user collateral at off-market rates and pocket the difference as the position closed. Across ~5 positions the attacker extracted ~8800 ETH + 213 BTC. Root cause is using the same DEX pair as both the execution venue *and* the price reference, without a TWAP or external oracle gate on slippage.