InternetToken exploit analysis

The InternetToken (INT) deployer on Base was drained on 2026-09-21 when a permissionless swapV3 wrapper accepted a caller-supplied Uniswap V3 pool and trusted its callback to mint INT (attack transaction, block 51593878). DeFiHackLabs reconstructs the exploit on a Base fork and reproduces both the mint and the WETH leg to the wei.

The vulnerable contract wraps a Uniswap V3 swap path: the user supplies a path array of token addresses and fees, the wrapper locates or creates the corresponding V3 pool, and on the post-swap callback it pays out the input token's "from" amount in INT to the caller. The wrapper never verifies that the pool it is talking to is the canonical V3 deployment for that pair: it accepts any contract that implements IUniswapV3Pool and that returns the right shape from a swap() call. The callback can therefore be a hostile contract that mints INT on demand.

The attacker deployed a fake pool whose swap() callback minted the requested INT into the wrapper's payout path. Across the run, the attacker minted 925.41M INT and dumped 161.27M of it into the canonical INT/WETH pool on Base for 5.846988 WETH. DeFiHackLabs records a net profit of 764,145,702 INT plus 5.846988 WETH, the wei value matching a reconstruction that mints through the same wrapper against the attacker's fake pool.

A correct implementation would resolve the pool address itself from the canonical Uniswap V3 factory for the supplied token pair and fee tier, and would refuse to swap against any contract that does not match that resolved address.