LeetSwap Hack

Reported loss $629K
Base
Liquidity Pools Compromised

What happened

On August 1, 2023, LeetSwap's Base AMM was exploited through an externally callable fee-transfer function in its pair contract. The attacker manipulated pool pricing and drained WETH from multiple pools. Contemporary reports put the outflow at roughly 340–342 ETH; the project paused trading and reported recovering ETH that had remained stuck in pools.

How it happened

  1. The attacker made a small swap to obtain tokens needed for the next transaction.
  2. They called the publicly exposed _transferFeesSupportingTaxTokens function, moving tokens from a pair to its fee address.
  3. That transfer distorted the pair's reserves; the attacker called sync on the axlUSD/WETH pool.
  4. The attacker reversed the swap at the manipulated price and repeated the method across pools to extract WETH.

Protocol details

Classification Protocol Logic / Exchange (DEX) / Access Control
Protocol Type DEX
Implementation language Solidity
Protocol links Website @LeetSwap

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes