Internet Token (INT) exploited for ~764M INT and 5.85 WETH via unvalidated pool callback and arbitrary mint in LiquidityUnifier contract.
Security & Exploits ·
Internet Token (INT) suffered an exploit resulting in the loss of approximately 764 million INT tokens and 5.85 WETH on the Base network. The attack occurred through a vulnerability in the LiquidityUnifier contract, which holds the MINTER_ROLE for the reward token. The contract's swapV3 function accepted an attacker-supplied pool without adequate validation, checking only that the pool had code and that its token0() and token1() functions returned INT.
The attacker deployed a malicious pool contract that returned INT for both token positions, allowing it to trigger a callback during the swap operation. This callback re-entered the uniswapV3SwapCallback function and minted an attacker-chosen quantity of INT to the currentPoolV3 address. By routing the transaction through a Convertor contract to circumvent the validateSupply check, the attacker was able to freely mint approximately 925 million INT tokens without authorization.
The attacker then liquidated a portion of the minted tokens into the legitimate INT/WETH Uniswap V3 pool, exchanging them for 5.85 WETH, while retaining a substantial quantity of the minted INT. The attack address still holds significant amounts of the stolen tokens, leaving open whether further liquidation or asset movement is underway.