LeetSwap Hack

TOTAL LOST $629K
Low Access Control Attacks base

What happened

Quick Summary

LeetSwap, an AMM-based DEX on Base chain, was exploited, resulting in a loss of 342.56 ETH worth 628,583 USD.

Details of the Exploit

On Aug 01, 2023, LeetSwap's AMM-based DEX running on Base chain was exploited. The attacker executed a sequence of malicious actions that allowed them to steal funds from the protocol. The steps involved:

  1. Swapping a small amount of WETH for X tokens (a transaction that should have incurred fees).
  2. Calling _transferFeesSupportingTaxTokens(address, uint256) to move the token to a Fees contract.
  3. Calling sync().
  4. Swapping X tokens for all the WETH from the pool.

As a result of these actions, approximately 342.56 ETH, equivalent to around 628,583 USD, were stolen.

Block Data Reference

Attacker Address:

https://basescan.org/address/0x705f7361…5085c3

Funds Holder Address as of August 1, 2023: https://basescan.org/address/0x5b030f90…f60a60

Malicious Transaction: https://basescan.org/tx/0xbb837d41…9f10ec

Malicious Contract Address: https://basescan.org/address/0xea8f89f4…b9f560

Case & protocol details

Classification Protocol Logic / Exchange (DEX) / Access Control
Protocol Type DEX
Smart Contract Language Solidity
Official Website leetswap.finance/
Protocol Twitter/X @LeetSwap

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks

Proof of concept

1 available

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes