BeatSwap exploited for $63.7K via oracle manipulation; attacker flash-loaned USDT and BTX, crashed pool price to drain vesting reserves.
Security & Exploits ·
BeatSwap suffered a loss of $63.7K on BNB Chain through oracle manipulation targeting its LiquidityVestingConvert contracts. The attacker executed a flash-loan attack using borrowed USDT and BTX, artificially depressing the pool price by dumping assets into the PancakeSwap V3 liquidity pool, then triggered a deposit that caused the protocol to compute and transfer approximately 3.07M BTX from its reserves at the manipulated price.
The vulnerability stemmed from BeatSwap's reliance on real-time slot0 price data from PancakeSwap V3 without time-weighted average price (TWAP) protections or oracle manipulation guards. The LiquidityVestingConvert contract's _calculateQuote and _executeMint functions read sqrtPriceX96 and currentTick directly from the pool, allowing the attacker to exploit the spot price during the flash-loan transaction. The amount1Min slippage safeguard proved ineffective because it validated against the already-manipulated quote rather than an independent price reference.
Vesting pool reserves at address 0x1e64… were drained, alongside holdings in a second victim pool at 0x9a7a…. The attacker reversed the initial swaps, repaid both flash loans, and retained roughly $63.7K USDT in profit. It remains unclear whether BeatSwap has deployed mitigations or whether additional protocols rely on similar unguarded oracle patterns.