Monday, September 21, 2026

Internet Token INT

Funds lost

$260K

Attack type

Other

Network

Base

Category

Token

Summary

On September 21, 2026, the Internet Token protocol on Base was exploited for 5.85 WETH and 764 million INT after an attacker leveraged an unvalidated Uniswap V3 pool callback parameter to arbitrarily mint ~925 million INT tokens.

Details of the Exploit

The vulnerability was present in INT's LiquidityUnifier contract (0x837d...), which held MINTER_ROLE rights and exposed an unvalidated swapV3(token, pool) function. The function only validated that the passed pool parameter contained bytecode and that its token0() and token1() getters returned the INT token address. The attacker deployed a malicious contract returning INT for both token endpoints, causing swapV3 to invoke pool.swap().

This callback re-entered uniswapV3SwapCallback and minted an arbitrary amount of INT tokens directly to the fake pool. The attacker routed the minted tokens through a Convertor contract round-trip to bypass validateSupply sanity checks, created ~925 million INT, dumped a portion into the official INT/WETH V3 pool for 5.85 WETH, and kept the remaining ~764 million INT.

Source: De.Fi REKT Database. Data as of November 9, 2026.