InfinitySix — Stale 1-min TWAP + Instant Referral Bonus Over-Mint

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-03-InfinitySix_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/InfinitySix_exp.sol.

Vulnerability classes: vuln/oracle/price-manipulation · vuln/logic/incorrect-calculation

Reproduction: Foundry PoC in this project folder — ONLINE archive fork (BSC). Verbose run: output.txt. Verified source: sources/InfinitySix.sol.

Key info#

TL;DR#

invest() immediately credits the sponsor with directBonus += 5% of the invest amount. withdraw() pays that USDT-denominated bonus in i6 tokens priced by twapPrice, but updateTwap() refuses to update more than once per minute. Inside one transaction the attacker:

1. Does a small self-invest under GENESIS_USER (locks TWAP ≈ 1.05 USDT/i6).
2. Routes $124M USDT through a helper that invests with the attacker as referrer → **$6.2M directBonus** + floods the LP (spot ≈ 15,528).
3. Calls withdraw() — TWAP still ~1.05 → mints ~5.6M i6 from the project reserve (fair amount at spot would be ~399 i6).
4. Dumps i6 into the USDT-heavy LP for ~$125.2M, repays capital, keeps ~$274K.

Vulnerable code#

Instant referral bonus (sources/InfinitySix.sol)#

if (user.referrer != address(0)) {
    User storage refUser = users[user.referrer];
    if (!refUser.isCapped) {
        refUser.directBonus += (usdtAmount * DIRECT_BONUS_RATE) / 1000; // 5%, immediate
    }
}

Stale TWAP floor#

uint32 public constant TWAP_UPDATE_INTERVAL = 1 minutes;

function updateTwap() public {
    // ...
    if (timeSinceLastUpdate < TWAP_UPDATE_INTERVAL) return; // same-tx: always early-return
    // ...
}

function withdraw() external nonReentrant {
    if (uniswapPair != address(0)) { updateTwap(); }
    // ...
    uint256 effectivePrice = twapPrice > minTwapPrice ? twapPrice : minTwapPrice;
    uint256 tokensToTransfer = (totalUsdtToWithdraw * WAD) / effectivePrice;
    // transfer i6 to msg.sender (minus 5% burn)
}

The sponsor’s 7× payout cap is sized so sponsorInvest * 7 ≈ referralInvest * 5% (885,815.60 × 7 = 6,200,709.20 = 5% of 124,014,184.40).

Attack flow#

PoC notes#

• ONLINE fork via BSC_RPC_URL (default https://bsc-mainnet.public.blastapi.io).
• Capital is deal’d USDT (live attack used Moolah WBNB flash → Venus → PancakeV3 flash).
• Run: BSC_RPC_URL=... forge test --match-contract InfinitySix_exp -vv
• Expected: [PASS], net profit > 100k USDT (observed ~277k).

Offline anvil_state.json not shipped (large multi-protocol state; ONLINE only).

References#

• ExVul: https://x.com/exvulsec/status/2038823338034987369
• DarkNavy write-up: https://www.darknavy.org/web3/exploits/infinitysix-twap-stale-price/

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-03-InfinitySix_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: InfinitySix_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "InfinitySix".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.