Internet Token INT Hack

On September 21, 2026, the Internet Token protocol on Base was exploited for 5.85 WETH and 764 million INT after an attacker leveraged an unvalidated Uniswap V3 pool callback parameter to arbitrarily mint ~925 million INT tokens.

The vulnerability was present in INT's LiquidityUnifier contract (0x837d...), which held MINTER_ROLE rights and exposed an unvalidated swapV3(token, pool) function. The function only validated that the passed pool parameter contained bytecode and that its token0() and token1() getters returned the INT token address. The attacker deployed a malicious contract returning INT for both token endpoints, causing swapV3 to invoke pool.swap().

This callback re-entered uniswapV3SwapCallback and minted an arbitrary amount of INT tokens directly to the fake pool. The attacker routed the minted tokens through a Convertor contract round-trip to bypass validateSupply sanity checks, created ~925 million INT, dumped a portion into the official INT/WETH V3 pool for 5.85 WETH, and kept the remaining ~764 million INT.

Attack Transaction Hash: 0xed62bb27…edb08b

Attacker Address: 0x5f7ce639…d1ec68

Victim Contract: 0x837dbabc…822032