BeatXswap LiquidityVestingConvert — UniV3 `slot0` spot oracle

Source & credit. Crypto Training original detection and analysis (live Twitter/X security-alert intake — not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-09-BeatXswapVestingOracle_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/oracle/spot-price · vuln/oracle/single-source · vuln/oracle/price-manipulation · vuln/logic/price-calculation

Reproduction: Foundry fork at BSC block 120873719 (one before the drain). deal() seeds the Moolah/Infinity flash inventory, dumps BTX into the 0.01% oracle pool, then deposit() mints LP from the vesting contracts' own BTX at the crashed slot0 quote. Offline anvil_state.json + _shared/run_poc.sh [PASS]. Alerts: SlowMist · DefimonAlerts.

Key info#

TL;DR#

BeatSwap's LV Convert lets users deposit USDT. 75% goes to a treasury; 25% is paired with protocol-owned BTX and minted as a Pancake V3 LP. The BTX amount is sized by _calculateQuote(), which converts USDT→BTX from the 0.01% pool's live slot0 sqrtPriceX96. There is no TWAP and no sanity bound. amount1Min is 97% of that already-manipulated quote, so it cannot protect the mint.

The attacker flash-borrowed ~6M BTX (Pancake Infinity) plus USDT (Moolah), dumped BTX into the V3 book to crash sqrtPriceX96, then called deposit(10_000e18) on the unlimited converter and deposit(2_000e18) on the one-time converter. At the crashed tick the converters minted LP using their own BTX reserves. Reversing the dump extracted that BTX through the pool. Live net ~63.7k USDT; SlowMist counted ~2.98M BTX / $77.5k.

Teaching PoC at block 120873719: seed 150k BTX + 15k USDT, dump into the oracle pool, deposit() both victims. 163,432.97 BTX leaves the vesting contracts (output.txt).

Background#

LV Convert is BeatSwap's public-round distribution: deposit USDT, receive a 180-day locked BTX–USDT LP plus linearly vesting BTX (with a 9.8% bonus). Protocol BTX is supplied in advance so depositors do not take swap slippage — which means a manipulated quote spends the protocol's BTX, not the user's.

Two live converters share the same oracle:

• LiquidityVestingConvert — min 10,000 USDT, repeatable (0x1e647…).
• LiquidityVestingConvertOnce — exact 2,000 USDT, one shot (0x9a7A…).

Both hardcode TARGET_POOL = 0xA5Db84d7… (Pancake V3 USDT/BTX fee 100).

The vulnerable code#

1. Quote is a single slot0 read#

sources/LiquidityVestingConvert_1e647F/project_contracts_LiquidityVestingConvert.sol — _calculateQuote:

function _calculateQuote(uint256 usdtAmountIn) internal view returns (uint256 btxAmountOut) {
    (uint160 sqrtPriceX96, , , , , , ) = IUniswapV3Pool(TARGET_POOL).slot0();
    uint256 ratioX192 = uint256(sqrtPriceX96) * uint256(sqrtPriceX96);
    address token0 = IUniswapV3Pool(TARGET_POOL).token0();

    if (token0 == address(USDT)) {
        btxAmountOut = Math.mulDiv(usdtAmountIn, ratioX192, 1 << 192);
    } else {
        btxAmountOut = Math.mulDiv(usdtAmountIn, 1 << 192, ratioX192);
    }
}

slot0().sqrtPriceX96 is the current tick's spot, freely moved by a same-block dump. No observe(), no max-change, no second pool.

2. Slippage check is computed from the same quote#

uint256 requiredBTX = _calculateQuote(usdtAmountToMint);
// ...
uint256 amount1Min = (requiredBTX * 97) / 100;
POSITION_MANAGER.mint(MintParams({
    amount0Desired: usdtAmountToMint,
    amount1Desired: requiredBTX,
    amount0Min: (usdtAmountToMint * 97) / 100,
    amount1Min: amount1Min,
    // ...
}));

amount1Min is 97% of the already crashed requiredBTX. It rejects a further 3% move during mint, not the flash dump that set the quote.

LiquidityVestingConvertOnce is the same oracle (_calculateQuote / _executeMint).

Root cause#

1. Single-source spot oracle. One V3 pool's slot0 is the only price.
2. Same-block manipulability. A dump in the same transaction moves sqrtPriceX96 before deposit().
3. Protocol-owned inventory. requiredBTX is pulled from the converter's BTX balance (InsufficientReserveBTX if short) and locked into an LP the attacker can then trade against.
4. 75/25 split does not help. Treasury takes 75% of USDT; the remaining 25% still sizes a BTX mint from the manipulated quote.

Preconditions#

• Converter holds a large BTX reserve (pre-attack: 1.240M on unlimited, 1.832M on one-time).
• Attacker can flash BTX (Infinity vault held ~25.3M BTX) and USDT (Moolah held ~2.59M USDT).
• deposit is unpaused and not onlyOwner.
• One-time converter still accepts the attacker's address (hasDeposited false).

Attack walkthrough#

Live tx 120873720 (constructor + nested run()):

1. Deploy exploit; flash USDT from Moolah (flashLoan).
2. Flash ~6M BTX from Pancake Infinity vault / CL (0xa0ff… / vault 0x238a…).
3. Dump BTX on the 0.01% oracle pool and the 0.30% pool — slot0 crashes.
4. LiquidityVestingConvert.deposit(10_000e18) and LiquidityVestingConvertOnce.deposit(2_000e18).
5. Reverse swaps; repay flashes; 63,704.84 USDT on the EOA.

Teaching PoC (fork 120873719, 150k BTX + 15k USDT seed):

The live 6M dump moved the book far enough to pull ~3.07M BTX (Defimon) / 2.98M BTX (SlowMist).

Diagrams#

Remediation#

• TWAP from IUniswapV3Pool.observe (or Pancake V3 equivalent) over many minutes; reject slot0 as a standalone mint oracle.
• Deviation cap vs a second venue (0.30% pool, CEX/Chainlink if any).
• Hard cap on BTX spent per deposit (absolute and vs TWAP).
• Size LP from a fixed BTX/USDT ratio set by governance, not a flash-loanable tick.
• Pause deposit on abnormal slot0 moves; keep amount1Min relative to a manipulation-resistant quote, not the same slot0 read.

How to reproduce#

cd audits/evm-hack-registry
_shared/run_poc.sh 2026-09-BeatXswapVestingOracle_exp -vvvvv
# expect [PASS] testExploit — 163,432.97 BTX drained from the two converters

Fork: BSC 120873719. Online: BSC_RPC_URL / https://bsc-mainnet.public.blastapi.io.

Reference: https://x.com/SlowMist_Team/status/2098314846765015062 · https://x.com/DefimonAlerts/status/2098273394261102968

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-09-BeatXswapVestingOracle_exp (evm-hack-registry mirror).
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.