BeatXswap
Sep 9, 2026
BeatXswap’s LiquidityVestingConvert contract used the live V3 pool slot0() price as its sole BTX pricing source, without a TWAP, deviation limit, or manipulation check. The attacker flash-borrowed BTX, dumped it into the BTX/USDT V3 pool to sharply reduce sqrtPriceX96, then deposited 10,000 USDT and 2,000 USDT into the vulnerable contracts.
The manipulated quote caused the contracts to contribute an excessive amount of their own BTX when minting LP positions, allowing the attacker to extract the BTX before reversing the swaps and repaying the flash loans.
How the exploit worked
View reproducible PoCslot0 spot-price oracle with no TWAP guard drains vesting BTX reserves.
Lost: ~$63.7K USDT net profit (2,984,557 BTX / ~$77.5K drained from two vesting reserves)
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Oracle Manipulation
- Technique
- Spot Price Manipulation
- Attribution
- Unknown
- Chains
Event timeline
- Sep 9, 2026Exploit executed — $78K drained via spot price manipulation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)