What happened
On December 1, 2024, an attacker exploited Spectral's Syntax V2 bonding curve contracts on Base. Spectral said the flaw affected select agent tokens on the bonding curves and was used to remove about $200K in liquidity; QuillAudits' analysis puts the drain at about 14,793 SPEC, worth roughly $250K at the time.
The root cause was an unintended infinite approval in the agent token contract (AgentToken.sol). During the tax calculation, the code granted AgentBalances.sol unlimited allowance to spend agent tokens held by the deployer contract. The attacker used that allowance to pull agent tokens out of the bonding curve, which made the remaining tokens look far more valuable against SPEC.
Spectral deactivated the Syntax app and paused the contracts after being alerted. In its post-mortem it said the bonding curve vulnerability was fixed, Zellic was engaged to audit the contract updates, and SPEC was being replenished to restore the bonding curves to their pre-exploit state. QuillAudits lists the attacker EOA as 0x000000000000E921f69f1df9E0540ccdD4847A0D and the vulnerable contract as 0xD84B6CAccFCc9FA5F48c6277C40FaC0620f1d0c2.
How it happened
- The attacker took a flash loan of SPEC.
- They swapped SPEC for an agent token with
swapExactSPECForTokens, then swapped back withswapExactTokensForSPEC, which ran the token's tax logic and triggered the unintended infinite approval toAgentBalances.sol. - They called
deposit()onAgentBalances.sol, using the approval to move almost all of the agent token balance out of the bonding contract. - With the agent token reserve nearly empty, the constant-product (XYK) curve priced the agent token far above its real value, so a small amount of it swapped back for an outsized amount of SPEC.
- Repeating the cycle drained about 14,793 SPEC from the curves.
Protocol details
Evidence
- report Spectral on X: vulnerability alert (Syntax bonding curve contracts) x.com
- report Spectral on X: Post-Mortem x.com
- report Decoding Spectra Lab's Bonding Contract $250K Exploit (QuillAudits) medium.com
- transaction Basescan transaction 0xa3535c70...5d62 basescan.org
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
