Incident Overview
LeetSwap, an AMM-based DEX on Base chain, was exploited, resulting in a loss of 342.56 ETH worth 628,583 USD.
On Aug 01, 2023, LeetSwap's AMM-based DEX running on Base chain was exploited. The attacker executed a sequence of malicious actions that allowed them to steal funds from the protocol. The steps involved:
1. Swapping a small amount of WETH for X tokens (a transaction that should have incurred fees).
2. Calling _transferFeesSupportingTaxTokens(address, uint256) to move the token to a Fees contract.
3. Calling sync().
4. Swapping X tokens for all the WETH from the pool.
As a result of these actions, approximately 342.56 ETH, equivalent to around 628,583 USD, were stolen.
Attacker Address:
https://basescan.org/address/0x705f7361…5085c3
Funds Holder Address as of August 1, 2023: https://basescan.org/address/0x5b030f90…f60a60
Malicious Transaction: https://basescan.org/tx/0xbb837d41…9f10ec
Malicious Contract Address: https://basescan.org/address/0xea8f89f4…b9f560
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to LeetSwap, these are the critical security checks that could have prevented this incident (August 2023).
- Verify all logic paths related to Liquidity Pools Compromised / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialProof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://twitter.com/BlockSecTeam/status/1686217464051539968
- Twitter/X Alert https://twitter.com/peckshield/status/1686209024587710464
Sources & References
Learn to Prevent the Next LeetSwap
The LeetSwap hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.