The Internet Token

The Internet Token’s privileged LiquidityUnifier contract had INT minting authority and exposed a permissionless swapV3(token, pool) function accepting a caller-supplied pool. Its validation only required the supplied address to contain code, not be excluded, and report INT and the requested token through token0()/token1().

swapV3() stored that address as currentPoolV3 and called its swap(), allowing the fake pool to invoke uniswapV3SwapCallback() with an attacker-selected amount. Because the callback trusted currentPoolV3, it caused the privileged contract to mint INT to the fake pool.

The attacker bypassed the surrounding supply-increase check by converting the newly minted INT through the project’s Convertor during the call, reducing supply before the check, and converting it back afterward. 85 WETH.