# MetaToken

## Idea

It is hard to write a detailed writeup for this chall so I will just summarize the idea here...

This is a read-only reentrancy chall that mimics the curve finance hack:

{% embed url="<https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/>" %}

The callback is here:

{% embed url="<https://github.com/ret2basic/QuillCTF-MetaToken/blob/30929348a8b364ce910718847be10cb8edfe0841/src/CurvePool.sol#L280>" %}

At this point the LP tokens are burned so totalSupply decreases, therefore get\_virtual\_price() returns higher price than expected:

{% embed url="<https://github.com/ret2basic/QuillCTF-MetaToken/blob/30929348a8b364ce910718847be10cb8edfe0841/src/CurvePool.sol#L82-L91>" %}

In the callback we can purchase MetaToken. We can buy a lot more because the LP tokens we still hold are more valuable in the callback. Once control flow exits our fallback function we can dump everything and profit.

## PoC

{% embed url="<https://github.com/ret2basic/QuillCTF-PoC/blob/main/MetaToken/test/PoC.t.sol>" %}
