Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/unverifiedcontractuniswapv3callbacklackingaccesscontrol.php}} {{Unattributed Sources}} Base Blockchain Logo/HomepageOn August 28th, 2025, an unverified smart contract was deployed on the Base blockchain containing a critical vulnerability: the uniswapV3SwapCallback function lacked proper access control. This allowed an attacker to exploit the contract u..."

2025-10-10T22:45:13Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/unverifiedcontractuniswapv3callbacklackingaccesscontrol.php}} {{Unattributed Sources}} thumb|Base Blockchain Logo/HomepageOn August 28th, 2025, an unverified smart contract was deployed on the Base blockchain containing a critical vulnerability: the uniswapV3SwapCallback function lacked proper access control. This allowed an attacker to exploit the contract u..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/unverifiedcontractuniswapv3callbacklackingaccesscontrol.php}}
{{Unattributed Sources}}

[[File:Baseblockchain.jpg|thumb|Base Blockchain Logo/Homepage]]On August 28th, 2025, an unverified smart contract was deployed on the Base blockchain containing a critical vulnerability: the uniswapV3SwapCallback function lacked proper access control. This allowed an attacker to exploit the contract using a delegatecall to another contract, resulting in a reported loss of approximately $88.9K. The incident was first analyzed and reported by TenArmor and researcher Weilin (William) Li, and later included in Blockthreat’s Week 36 report. The responsible project remains unidentified, and there is currently no indication of an ongoing investigation or recovery efforts.<ref name="tenarmortweet-21139" /><ref name="basescantransaction-21140" /><ref name="hklst4rtweet-21141" /><ref name="blockthreat-21142" /><ref name="blockscoutrawtrace-21143" /><ref name="victimbasescan-21144" /><ref name="victimcreationbasescan-21145" /><ref name="vulnerablebasescan-21146" /><ref name="deletegatedcreationbasedscan-21147" />

== About Unverified Contract ==
An unverified smart contract was launched on the Base blockchain on August 28th, 2025.

This invokes code in another smart contract via a delegatecall.

== The Reality ==
Unfortunately, the smart contract was launched with a vulnerability where the uniswapV3Callback function lacked access control.

== What Happened ==
An unverified smart contract on the Base blockchain was exploited due to a missing access control in the uniswapV3SwapCallback function, resulting in a reported loss of $88.9K.
{| class="wikitable"
|+Key Event Timeline - Unverified Contract uniswapV3Callback Lacking Access Control
!Date
!Event
!Description
|-
|August 28th, 2025 3:35:11 PM MDT
|Victim Smart Contract Launched
|The victim smart contract is first launched on the Base blockchain.
|-
|August 29th, 2025 5:55:05 AM MDT
|Delegated Smart Contract Launched
|The smart contract starting with 0x1d9e is launched, containing a vulnerability due to the lack of access control on uniswapV3Callback.
|-
|September 1st, 2025 12:38:27 AM MDT
|Base Attack Transaction
|The attack is accepted into the Base blockchain.
|-
|September 1st, 2025 1:13:00 AM MDT
|TenArmor Tweet Posted
|TenArmor posts a tweet with details about the xploit.
|}

== Technical Details ==
According to an initial analysis by TenArmor, "[i]t appears that the uniswapV3SwapCallback function of the contract 0x1d9e lacks access control, which was exploited by the attacker."

== Total Amount Lost ==
TenArmor has reported that there was "an approximately loss of $88.9K".

The total amount lost has been estimated at $89,000 USD.

== Immediate Reactions ==
The incident was reported by TenArmor and researcher Weilin (William) Li.

== Ultimate Outcome ==
It appears that the incident was included in the Blockthreat report for Week 36 of 2025.

== Total Amount Recovered ==
There is limited information available about the smart contract, and no suggestion that any recovery is presently being attempted.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
It's unclear which project is behind this address, and whether any investigation is underway.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-21139">[https://twitter.com/TenArmorAlert/status/1962413608182128843 TenArmor - "Our system has detected a suspicious attack involving #unverified contract 0x46cbe on #BASE, resulting in an approximately loss of $88.9K." - Twitter/X] (Accessed Sep 19, 2025)</ref>

<ref name="basescantransaction-21140">[https://basescan.org/tx/0xdc6658ce341f5699915cf33ef5f4d3d6298c841f4c333d31543f6ec6ff8dd2ea Attack Transaction - BaseScan] (Accessed Sep 19, 2025)</ref>

<ref name="hklst4rtweet-21141">[https://twitter.com/hklst4r/status/1962432786687463699 Weilin (William) Li - "yet another uniswapV3Callback lacking access control." - Twitter/X] (Accessed Sep 19, 2025)</ref>

<ref name="blockthreat-21142">[https://newsletter.blockthreat.io/p/blockthreat-week-36-2025 BlockThreat - Week 36, 2025] (Accessed Sep 19, 2025)</ref>

<ref name="blockscoutrawtrace-21143">[https://base.blockscout.com/tx/0xdc6658ce341f5699915cf33ef5f4d3d6298c841f4c333d31543f6ec6ff8dd2ea?tab=raw_trace Transaction details - Blockscout] (Accessed Sep 19, 2025)</ref>

<ref name="victimbasescan-21144">[https://basescan.org/address/0x46cbe774bd057dfc9b09a5781020e9a6ec9639bb Victim Smart Contract - BaseScan] (Accessed Sep 19, 2025)</ref>

<ref name="victimcreationbasescan-21145">[https://basescan.org/tx/0x31ccb12d43f856b44bdf09a11dfddf47b198596aafae5ddf4108a1641493ceee Victim Smart Contract Creation Transaction - BaseScan] (Accessed Sep 19, 2025)</ref>

<ref name="vulnerablebasescan-21146">[https://basescan.org/address/0x1d9e1b7e57a8c8c6fe8f6eef52d63df399665098 Vulnerable Smart Contract - BaseScan] (Accessed Sep 19, 2025)</ref>

<ref name="deletegatedcreationbasedscan-21147">[https://basescan.org/tx/0xcf9e53e327fa73b0cadb6b5ec1459a5f53ead3a2d719b2c3692f4461877dc2d6 Creation Of Delegated Smart Contract - BaseScan] (Accessed Sep 19, 2025)</ref></references>

Unverified Contract uniswapV3Callback Lacking Access Control - Revision history