SynapLogic Hack

On January 20, 2026, SynapLogic on Base suffered an $186,000 exploit when attackers manipulated the referral logic in the swapExactTokensForETHSupportingFeeOnTransferTokens function, setting themselves as referrers 31 times to receive 310% of their spending back in native tokens while also receiving minted SYP tokens.

BlockSec Phalcon identified the root cause as a business logic fault in implementation contract 0xC859. The contract's token purchase function allowed users to provide a refBy parameter containing referral addresses, each receiving 10% of the ETH or USDC spent. However, the function failed to validate this parameter or check whether total payouts exceeded the actual payment received (msg.value).

The attacker exploited this by filling the refBy array with their own address 31 times, resulting in 31 x 10% = 310% of their spending being returned as native tokens, while simultaneously receiving freshly minted SYP tokens. This allowed draining the purchasing contract of more value than the attacker deposited. A second attacker later replicated the pattern, setting refBy = 10 x [self] to mint SYP tokens without paying anything.

Notably, neither attacker was able to sell the minted SYP tokens because the tokens were locked in a vesting state rather than being immediately transferable or exchangeable. TenArmor's security system first detected the attack, and SynapLogic subsequently paused the contract.

Attack Transaction: https://basescan.org/tx/0xc54c0004…76c4b1

Exploiter:

https://basescan.org/address/0x3aa8bb3a…e30f38

Vulnerable Function: swapExactTokensForETHSupportingFeeOnTransferTokens (0x670a3267)