TesseraSwap exploit analysis
TesseraSwap's callback repayment priced itself from the swap's own post-state, so the attacker moved the same-block price and kept the spread. DeFiHackLabs reconstructs about $20K drained on Base.
- Reported loss
- ~$20K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-18: Callback Repayment Price Spread on TesseraSwap”.
Analysis1 min read
TesseraSwap's callback repayment read a price spread that the attacker had already moved in the same block, comparing the post-swap price against the pre-swap price. The attacker opened a swap that the callback repaid against a smaller-than-actual spread, keeping the spread as profit.
DeFiHackLabs reconstructs the sequence against the live Base state; the drain is in 0xc2df72ff612c90e07c9e051e7772a39f31fb4ca9e61f5b705f921bffa26b36de on Basescan for a total loss of about $20K. Defimon Alerts' Telegram channel reported the incident.
What would have prevented it: a callback repayment price taken from an external oracle rather than the swap's own post-state.
Sources read (3)
Other exploits
- MureDistribution exploit analysis 21 May 2026
- MAPProtocol exploit analysis 20 May 2026
- ElevateFi exploit analysis 19 May 2026
- SEAToken exploit analysis 17 May 2026
- VerusBridge exploit analysis 17 May 2026
- AdsharesBridge exploit analysis 15 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
