Swapos Hack

What happened

On April 16, 2023, an attacker drained most SWP from Swapos's SWP/WETH pool. A technical reconstruction reports that 10 wei of WETH input allowed 142,658.16 SWP to be withdrawn, leaving roughly 3,000 SWP in the pool.

How it happened

1. The attacker sent 10 wei of WETH to the SWP/WETH pair.
2. The attacker requested 142,658.16 SWP in the pair's swap call.
3. The pair's adjusted-balance check used 10,000 scaling on the left side but retained 1,000 squared scaling on the right side.
4. That mismatch made the invariant about 100 times too permissive, so the oversized SWP withdrawal passed and the reserves were updated.

Protocol details

Classification Exchange (DEX) / Protocol Logic

Protocol Type Exploit/Other

Affected asset / contract SWP

Implementation language Solidity

Protocol links Website @Swapos_org

Evidence

• analysis DeFiLlama defillama.com
• analysis Swapos V2 Pair Exploit — Broken k-Value Invariant Lets 10 wei of WETH Drain ~98% of the Pool's SWP crypto.training