Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/shibaswaptreasurefinderconverteoarestrictionbypass.php}} {{Unattributed Sources}} ShibaSwap Logo/HomepageA vulnerability in the ShibaSwap: Treasure Finder smart contract led to an exploit resulting in an estimated $27,000 loss. The issue stemmed from the convert() function lacking slippage protection during LEASH-to-WETH swaps, making it vulnerable to sandwi..."

2025-08-27T21:43:03Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/shibaswaptreasurefinderconverteoarestrictionbypass.php}} {{Unattributed Sources}} thumb|ShibaSwap Logo/HomepageA vulnerability in the ShibaSwap: Treasure Finder smart contract led to an exploit resulting in an estimated $27,000 loss. The issue stemmed from the convert() function lacking slippage protection during LEASH-to-WETH swaps, making it vulnerable to sandwi..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/shibaswaptreasurefinderconverteoarestrictionbypass.php}}
{{Unattributed Sources}}

[[File:Shibaswap.jpg|thumb|ShibaSwap Logo/Homepage]]A vulnerability in the ShibaSwap: Treasure Finder smart contract led to an exploit resulting in an estimated $27,000 loss. The issue stemmed from the convert() function lacking slippage protection during LEASH-to-WETH swaps, making it vulnerable to sandwich attacks. Additionally, the onlyEOA() modifier, meant to restrict access to externally owned accounts, was bypassed using EIP-7702-compliant accounts, which mimic EOAs. The attacker used this to manipulate token prices and drain funds. No official acknowledgment, recovery, or follow-up appears to have been made by ShibaSwap’s team. The incident appears to have ended with a retained loss.<ref name="tenarmortweet-21063" /><ref name="etherescan1-21064" /><ref name="etherscan2-21065" /><ref name="etherscan3-21066" /><ref name="eigenphitweet-21067" /><ref name="shibaswaphomepage-8723" /><ref name="shibaswapdextwitterx-21068" />

== About ShibaSwap ==
The ShibaSwap platform offers a comprehensive suite of decentralized finance (DeFi) tools, including token swaps, liquidity pools, and bridging services. Users can interact with a wide range of tokens such as SHIB, LEASH, BONE, and TREAT, as well as stablecoins like USDT, USDC, and DAI. The interface also provides access to support, FAQs, a testnet faucet, and developer resources, making it accessible for both new and experienced users. Token prices and their daily performance are prominently displayed, showing market trends across the ShibaSwap ecosystem.

The liquidity pools on ShibaSwap are diverse and active, with over 1,100 pools listed. Popular pairs include SHIB-WETH, LEASH-WETH, and BONE-WETH across both V1 and V2 pool versions. Each listing shows key metrics such as total liquidity, trading volume, and number of swaps, offering transparency into pool activity. Users can also create new liquidity positions or add liquidity to existing pools directly from the interface, facilitating participation in earning fees and supporting token liquidity.

In addition to swap and liquidity functions, ShibaSwap highlights trending and recently created tokens, allowing users to discover new opportunities. Ecosystem statistics reveal a strong presence, with $13 million in total value locked and nearly $1 million in daily trading volume. The broader Shiba Inu ecosystem is integrated through features like Shibarium, the Shib Metaverse, Shib Names, and more, signaling a push toward a more expansive decentralized infrastructure.

== The Reality ==
The ShibaSwap: Treasure Finder smart contract contained two key vulnerabilities: the convert() function lacks slippage protection when swapping LEASH tokens for WETH, making it susceptible to price manipulation; and the onlyEOA() modifier, intended to restrict access to externally owned accounts, can be bypassed using EIP-7702-compliant accounts that behave like EOAs.

== What Happened ==
A vulnerability in ShibaSwap's Treasure Finder contract—lacking slippage protection and using a bypassable onlyEOA() check—was exploited via sandwich attacks, resulting in a $27,000 loss.
{| class="wikitable"
|+Key Event Timeline - ShibaSwap Treasure Finder Convert() EOA Restriction Bypass
!Date
!Event
!Description
|-
|August 22nd, 2025 1:24:23 AM MDT
|First Attack Transaction
|The first attack transaction was mined on the Ethereum blockchain.
|-
|August 24th, 2025 8:28:47 AM MDT
|Second Attack Transaction
|The second attack transaction is mined by the Ethereum blockchain. This transaction was reportedly made by a MEV bot.
|-
|August 24th, 2025 8:29:00 AM MDT
|Post About Second Transactions
|A Twitter/X bot called EighenPhi_Alert posts about this transaction as a MEV bot making $2.3k with a ROI of 108,654% using 4 tokens.
|-
|August 24th, 2025 12:49:47 PM MDT
|Third Attack Transaction
|The third attack transaction is mined by the Ethereum blockchain.
|-
|August 24th, 2025 8:30:00 PM MDT
|TenArmor Tweet Posted
|TenArmor posted a security alert warning of multiple sandwich attacks on the ShibaSwap: Treasure Finder contract, resulting in an estimated $27K loss. The vulnerability was attributed to the convert() function lacking slippage protection when swapping LEASH for WETH, allowing attackers to manipulate prices and gain extra LEASH tokens. Additionally, attackers bypassed the onlyEOA() check using an EIP-7702 account, which mimics externally owned accounts.
|}

== Technical Details ==
The vulnerability in the ShibaSwap: Treasure Finder contract centers around the convert() function, which handles token swaps—specifically, converting LEASH tokens to WETH. This function lacks slippage protection, a mechanism meant to limit the price impact of a trade. Without slippage limits, attackers can exploit the function via sandwich attacks: by front-running the swap with their own transactions to manipulate the token price, they can cause the convert() function to execute at an unfavorable rate, and then profit by reversing the price movement afterward. This leads to the attacker ending up with more LEASH tokens than they should, effectively draining value from the protocol.

Compounding this vulnerability, the onlyEOA() modifier—intended to restrict function calls to Externally Owned Accounts (EOAs)—was bypassed using an EIP-7702-compliant account. EIP-7702 introduces a new account abstraction model that allows smart contract wallets to appear like EOAs in certain contexts. This means that attackers could use a contract-based wallet that behaves like an EOA, tricking the onlyEOA() check and gaining unauthorized access to functions that should have been restricted.

The attacker used a deceptive account type to pass access controls, then leveraged the lack of slippage safeguards to manipulate token swaps in their favor.

== Total Amount Lost ==
The loss amount was reported as being approximately $27k by TenArmor.

The total amount lost has been estimated at $27,000 USD.

== Immediate Reactions ==
There does not appear to be any notice or details posted on the @ShibainuCoin or @ShibaSwapDEX Twitter/X pages.

== Ultimate Outcome ==
It's believed that there was no recovery or further investigation.

== Total Amount Recovered ==
There are no reports of any funds being recovered.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
The case appears to be concluded with permanent loss.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-21063">[https://twitter.com/TenArmorAlert/status/1959805512184140043 Ten Armor - "Our system has detected multiple suspicious sandwich attacks involving #ShibaSwap: Treasure Finder @ShibainuCoin @ShibaSwapDEX on #ETH, resulting in an approximately loss of $27K." - Twitter/X] (Accessed Aug 26, 2025)</ref>

<ref name="etherescan1-21064">[https://etherscan.io/tx/0xc5a388c3d94bdba3a2184f558c85d079aeaf2fbe5604bae07e96433a1a9ef188 First Attack Transaction - Etherscan] (Accessed Aug 26, 2025)</ref>

<ref name="etherscan2-21065">[https://etherscan.io/tx/0x18d9f84e106e26bdfe849ec7034a839b51cca715c84e380727d513276fea8fed Second Attack Transaction - Etherscan] (Accessed Aug 26, 2025)</ref>

<ref name="etherscan3-21066">[https://etherscan.io/tx/0x5c17e81b5b976cff66933bc4082ac3e9b21355a455d1864ae5f8ce6d069ea8e7 Third Attack Transaction - Etherscan] (Accessed Aug 26, 2025)</ref>

<ref name="eigenphitweet-21067">[https://twitter.com/EigenPhi_Alert/status/1959624004870005121 EigenPhi - "#MEV made $2,329 with a ROI of 108,654% from #Arbitrage , using 4 tokens ( $ETH , $WETH , $SSLP , $LEASH ):" - Twitter/X] (Accessed Aug 26, 2025)</ref>

<ref name="shibaswaphomepage-8723">[https://shibaswap.com/ Shibaswap] (Accessed Jul 23, 2022)</ref>

<ref name="shibaswapdextwitterx-21068">[https://twitter.com/ShibaSwapDEX ShipaSwapDEX Twitter/X] (Accessed Aug 26, 2025)</ref></references>

ShibaSwap Treasure Finder Convert() EOA Restriction Bypass - Revision history