EtherVista DEX has a live uint112 overflow vulnerability in swap() affecting 261 pairs, exploitable for ~116 WETH total; attacker proposing router replacement contract with revenue split.
Security & Exploits ·
An on-chain message sent to EtherVista DEX operators describes an active uint112 overflow vulnerability in the protocol's swap() function affecting 261 trading pairs on Ethereum mainnet. The vulnerability reportedly exposes approximately 116 WETH to extraction, with the attacker claiming each pair can be drained for 1 wei through exploitation of integer overflow in reserve calculations.
The exploit mechanism relies on a gap between fair pricing provided by EtherVista's current router contract and the actual reserve state created by the overflow condition. The attacker contends that normal swaps using the existing router do not capture this discrepancy, leaving it open to extraction. The sender proposes replacing the router with an alternative contract (0x6d05320dEF5685f42C8779B2130c87ED7B97b862) that uses identical swap math but incorporates a hard-coded revenue split.
The proposal allocates approximately 57 WETH to EtherVista operators as a 50/50 split and claims the replacement router can be reverted at any time. It remains unclear whether EtherVista has acknowledged the vulnerability report, whether the proposed contract has been independently audited, or what remediation steps the protocol may have already taken. The on-chain message format suggests this may represent a direct solicitation rather than a public disclosure.