CryptoBottle Hack

Reported loss $527K
Other

What happened

In October 2024, CryptoBottle on Polygon was exploited three times, losing about $527k in total according to CertiK:

  • **October 1:** about $6k, through missing access control on a contract's withdrawUserLIquidity() function.
  • **October 22:** about $31k from the CryptoCuvee contract, where a bug let the attacker buy every Cryptobottle and extract its contents at once.
  • **October 24:** about $490k, the largest attack, on the Navigator's Advantage contract.

Users could get NAS tokens from Navigator's Advantage by minting or by swapping. A fixedPriceEnabled flag decided which path applied, and public functions let anyone switch it on or off. With the flag on, swap() skipped its balance check after the callback, so the attacker could trade 1 USDT for millions of NAS. The attacker then switched the flag off and sold the NAS for the pool's USDT.

Between 15:00 and 15:30 on October 24, 493,652.17 USDT reached the attack addresses. Within an hour it moved to [0x5ec50b39829ab40291745fea6e11f10f3845fadb](Address 0x5ec5…fadb), the wallet CertiK also linked to the October 22 exploit. The funds were still there when CertiK published its analysis on October 31.

Attacker: [0x9cE632E5FDB7151ee84e55Cf323CDb7A2977C7CE](Address 0x9cE6…C7CE)

Attack contract: [0xfCDd0d0A914bE6e64AE099646CCda189F8323556](Address 0xfCDd…3556)

Vulnerable contract: [0x5d6084Bf7a8049Fd3db89a7af9e7291002F36Ac7](Address 0x5d60…6Ac7)

How it happened

  1. The attacker called a public function (selector 0xeebe2e12) to set fixedPriceEnabled to true on Navigator's Advantage. This turned off swap()'s balance check after the callback.
  2. The attacker made lopsided swaps, each trading 1 USDT for up to 40 million NAS (CertiK lists swaps for 1,000, 10,000 and 40 million NAS).
  3. The attacker set fixedPriceEnabled back to false.
  4. The attacker sold the NAS for USDT, draining the contract's USDT liquidity.
  5. About 493,652 USDT was moved to 0x5ec50b..., the wallet linked to the October 22 CryptoCuvee exploit.

Protocol details

Classification NFT
Protocol Type Exploit/Other
Protocol links @NFTCryptoBottle

Evidence

Same attack technique

Browse all hacks →
FortuneWheel $21.0M lost FEG (Feed Every Gorilla) $900K lost Pike Finance $300K lost Narwhal $1.6M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes