{"investigation":{"slug":"leetswap","entity_name":"LeetSwap","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"LeetSwap was a decentralized exchange (DEX) launched on Coinbase's Base Layer 2 network in mid-2023 and briefly held the position of the network's largest DEX by trading volume and total value locked. On August 1, 2023, shortly after Base's mainnet opened to all users, an attacker exploited a publicly exposed smart contract function to drain approximately 342 ETH (~$630,000) from multiple liquidity pools. The protocol halted trading, partially recovered funds through white-hat rescue operations, and has since operated at a fraction of its pre-exploit TVL, with no public audit ever confirmed prior to the incident.","sections":[{"content":"LeetSwap is a decentralized exchange built on Coinbase's Base Layer 2 blockchain. The protocol describes itself as a DEX and DeFi ecosystem for 'leet degens,' offering dual-token farm rewards and automated market-making services. Its smart contracts are forked from Solidly, an automated market maker (AMM) that itself is derived from the Uniswap V2 architecture. LeetSwap was initially deployed on the Canto blockchain, having been built in February 2023 during a Canto hackathon, before expanding to Base. At its peak on July 31, 2023 — just as Base opened to public users — LeetSwap reported a total value locked (TVL) of approximately $41.2 million, making it the leading DEX on the network by that metric. The protocol hosted approximately 100 token pairs, including a significant number of meme coins that proliferated during Base's launch period. The team behind LeetSwap has not been publicly identified; no founders, core contributors, or corporate entities are disclosed in official documentation or verifiable public sources.","heading":"Background and Protocol Overview","sources":[{"url":"https://www.coindesk.com/business/2023/08/01/leetswap-halts-trading-after-630k-drained-from-liquidity-pairs","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/150826/leetswap-dex-pauses-trading-base-due-potential-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://docs.leetswap.finance/products/leetswap-v2-dex/","name":"docs.leetswap.finance","type":"other","credibility":3},{"url":"https://defillama.com/protocol/leetswap","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 1, 2023, LeetSwap's liquidity pools were exploited due to a critical access control vulnerability in the LeetSwapV2Pair smart contract. The root cause was a function visibility misconfiguration: the internal function `_transferFeesSupportingTaxTokens()` was incorrectly assigned a `public` visibility specifier, meaning any external actor could call it. The attacker's method involved three steps: (1) swapping WETH for a target token (token A) within a pool; (2) invoking the exposed `_transferFeesSupportingTaxTokens()` function to transfer token A to the fee-collection address and then calling the `sync()` function, artificially inflating token A's price within the pool; and (3) swapping the now-overvalued token A back for WETH, draining the pool's ETH reserves at a favorable rate. This sequence was executed across multiple liquidity pools. Multiple independent blockchain security firms — including PeckShield, CertiK, Beosin, and BlockSec — confirmed the attack vector and total losses on-chain. Wintermute research head Igor Igamberdiev also publicly attributed the drain to the exposed function. The attacker's wallet has been identified on-chain as 0x705f73..., with the attack contract at 0xea8f89... and the vulnerable contract at 0x94dac4.... Total funds drained amounted to approximately 342 ETH, valued at roughly $624,000–$630,000 at the time of the incident. LeetSwap's TVL collapsed from $41.2 million on July 31 to approximately $7.17 million on August 1, an 83% decline.","heading":"August 2023 Smart Contract Exploit","sources":[{"url":"https://medium.com/coinmonks/leetswap-hack-analysis-81323527b3f7","name":"medium.com","type":"other","credibility":3},{"url":"https://coinedition.com/exploit-on-leetswap-leads-to-loss-of-624k-due-to-price-manipulation/","name":"coinedition.com","type":"other","credibility":3},{"url":"https://beincrypto.com/leetswap-exploit-steals-eth-smart-contract-bug/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/08/01/leetswap-halts-trading-after-630k-drained-from-liquidity-pairs","name":"coindesk.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/base-dex-leetswap-stops-trading-cites-exploit/","name":"bitcoinist.com","type":"other","credibility":3}],"severity":"medium"},{"content":"LeetSwap's team responded to the exploit by activating a security pause function inherited from the Solidly codebase, halting all trading. The team's public statement read: 'We noticed that some pool liquidity might have been compromised and we temporarily stopped the trading to investigate.' Users with unlocked liquidity were permitted to withdraw their funds during the trading suspension. LeetSwap stated it was working with on-chain security experts to recover funds still locked in vulnerable pools. The protocol attempted to negotiate with the attacker via public social media posts, requesting the return of all stolen funds minus 50 ETH (~$92,000, approximately 15% of the total) as an implied bounty. Subsequent updates indicated that the team successfully recovered a total of 314 ETH from at-risk liquidity pools through white-hat rescue operations, with those funds earmarked for distribution back to affected liquidity providers and project teams. LeetSwap created a formal application process for affected project teams to reclaim their rescued liquidity. The team also warned users about fake airdrop announcements circulating on social media following the exploit, confirming no official airdrop had been authorized. Some pools could not be fully rescued due to limitations imposed by custom tax token contract architectures.","heading":"Team Response and Fund Recovery","sources":[{"url":"https://www.coindesk.com/business/2023/08/01/leetswap-halts-trading-after-630k-drained-from-liquidity-pairs","name":"coindesk.com","type":"other","credibility":3},{"url":"https://insidebitcoins.com/news/bases-leetswap-dex-halts-trading-following-a-630k-exploit-from-liquidity-pools","name":"insidebitcoins.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=leetswap-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2098625","name":"chaincatcher.com","type":"other","credibility":3},{"url":"https://www.binance.com/en/square/post/2023-08-04-leetswap-debunks-fake-airdrop-news-and-reviews-withdrawal-applications-909894","name":"binance.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No pre-deployment security audit of the LeetSwapV2Pair smart contracts by a recognized third-party firm has been publicly confirmed or disclosed. The vulnerability exploited — an incorrectly set function visibility specifier (`public` instead of `private` or `internal`) — is a class of error that standard smart contract audits routinely detect. LeetSwap's team acknowledged that its contracts were forked from Solidly but did not provide documentation of any audit performed on LeetSwap-specific modifications introduced during the fork process. The LeetSwap GitHub organization lists its leet-aggregator repository with an explicit 'use at your own risk' disclaimer, indicating the team's awareness of unaudited code risks. The exploit occurred within days of Base's mainnet becoming publicly accessible, suggesting the contracts were deployed under significant time pressure to capture first-mover positioning in the nascent ecosystem. Security commentary at the time from firms including PeckShield and Beosin focused on the access control flaw as straightforward and detectable, reinforcing the assessment that adequate pre-launch auditing was absent.","heading":"Security Posture and Audit History","sources":[{"url":"https://medium.com/coinmonks/leetswap-hack-analysis-81323527b3f7","name":"medium.com","type":"other","credibility":3},{"url":"https://coinedition.com/exploit-on-leetswap-leads-to-loss-of-624k-due-to-price-manipulation/","name":"coinedition.com","type":"other","credibility":3},{"url":"https://github.com/LeetSwap/leet-aggregator","name":"github.com","type":"other","credibility":3},{"url":"https://beincrypto.com/leetswap-exploit-steals-eth-smart-contract-bug/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Crypto on-chain investigator ZachXBT publicly flagged LeetSwap in connection with the August 2023 exploit. In a widely circulated social media post, ZachXBT commented on the incident with: 'The issue is you got hacked by North Korea that's what lol,' a reference to the Lazarus Group attribution narrative that was circulating at the time in the broader Base ecosystem following the CoinsPaid hack. This statement was interpreted as sardonic commentary on the exploit rather than a formal attribution claim. Multiple security researchers engaged with the incident publicly, and the exploit received coverage from major crypto-focused news outlets including CoinDesk, CoinTelegraph, The Block, and Decrypt. The incident coincided with a period of elevated security concerns on Base, including the BALD memecoin rug pull on July 30–31, 2023, in which the deployer withdrew approximately $12.5 million in liquidity. The simultaneous occurrence of multiple incidents in rapid succession on Base during its launch week drew significant community scrutiny toward LeetSwap's practices and the broader quality of protocols rushing to establish early market positions.","heading":"ZachXBT Flagging and Community Reaction","sources":[{"url":"https://bitcoinist.com/base-dex-leetswap-stops-trading-cites-exploit/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/242402/leetswap-bases-leading-dex-halts-trading-amid-reports-of-an-exploit","name":"theblock.co","type":"other","credibility":3},{"url":"https://decrypt.co/150826/leetswap-dex-pauses-trading-base-due-potential-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=leetswap-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit and partial recovery, LeetSwap did not publicly announce a full relaunch with remediated contracts or a verified security audit. The protocol's TVL remained substantially diminished relative to its pre-exploit peak. Current on-chain data from DeFiLlama indicates the protocol's active DEX TVL on Base stands at approximately $9,440, representing a near-total collapse from the pre-exploit figure of $41.2 million. The LEET native token continued to trade on secondary markets but at sharply reduced valuations. LeetSwap also appears in active form on the Linea blockchain, suggesting the team pivoted expansion efforts rather than fully rebuilding the Base deployment. The team has not released any confirmed post-incident security audit or transparency report. No regulatory action or law enforcement investigation has been publicly announced in connection with the exploit or the attacker's identity.","heading":"Post-Exploit Status and Current TVL","sources":[{"url":"https://defillama.com/protocol/leetswap","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coincarp.com/currencies/leetswap/","name":"coincarp.com","type":"other","credibility":3},{"url":"https://whattofarm.io/tokens/leetswap-linea-leet","name":"whattofarm.io","type":"other","credibility":3},{"url":"https://www.bitget.com/price/leetswap","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The LeetSwap exploit occurred during a uniquely turbulent period in Base's history. Coinbase's Base network opened to the general public on August 9, 2023, but developers had access from July 13 onward. During the developer access window and in the immediate days following public launch, Base experienced a cluster of high-profile negative events. The BALD memecoin, widely speculated to be connected to Coinbase CEO Brian Armstrong due to thematic resonance, executed what was characterized as a rug pull on July 30–31, 2023, when its deployer withdrew approximately $12.5 million in ETH from liquidity pools, causing an 85% price collapse. Approximately 30 additional meme coins on Base also performed rug pulls during this window. The LeetSwap exploit followed on August 1. This concentration of incidents colored early perception of the Base ecosystem's security and due diligence standards, and situated LeetSwap's exploit within a pattern of inadequately secured or intentionally malicious projects racing to capitalize on new-network attention.","heading":"Ecosystem Context: Base Launch Week Incidents","sources":[{"url":"https://www.coindesk.com/business/2023/08/01/leetswap-halts-trading-after-630k-drained-from-liquidity-pairs","name":"coindesk.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/base-dex-leetswap-stops-trading-cites-exploit/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=leetswap-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://cryptozombies.io/videos/en/2023-08-04-crypto-news-for-curve-liquidation-bald-leetswap-consensys","name":"cryptozombies.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-02","event":"LeetSwap contracts initially built and deployed on Canto blockchain during a monthly hackathon.","source":"","date_original":"2023-02-01"},{"date":"2023-07-13","event":"Coinbase opens Base mainnet to builders; LeetSwap deploys on Base and begins accumulating TVL.","source":""},{"date":"2023-07-30","event":"BALD memecoin rug pull on Base drains approximately $12.5 million in ETH liquidity, setting a turbulent backdrop for the Base ecosystem.","source":""},{"date":"2023-07-31","event":"LeetSwap reaches peak TVL of approximately $41.2 million, holding position as Base's largest DEX.","source":""},{"date":"2023-08","event":"Attacker exploits the publicly exposed `_transferFeesSupportingTaxTokens()` function in LeetSwapV2Pair contract, draining approximately 342 ETH (~$630,000) from multiple liquidity pools.","source":"","date_original":"2023-08-01"},{"date":"2023-08","event":"LeetSwap halts all trading and activates the Solidly-inherited factory security pause function.","source":"","date_original":"2023-08-01"},{"date":"2023-08","event":"PeckShield, CertiK, Beosin, and BlockSec confirm the exploit on-chain. Wintermute research head Igor Igamberdiev publicly attributes the drain to the exposed function.","source":"","date_original":"2023-08-01"},{"date":"2023-08","event":"LeetSwap TVL collapses from $41.2 million to approximately $7.17 million, an 83% decline.","source":"","date_original":"2023-08-01"},{"date":"2023-08","event":"ZachXBT publicly flags LeetSwap and comments on the exploit via social media.","source":"","date_original":"2023-08-01"},{"date":"2023-08","event":"LeetSwap posts public message requesting attacker return all funds except 50 ETH (~$92,000).","source":"","date_original":"2023-08-01"},{"date":"2023-08-04","event":"LeetSwap publicly denies fake airdrop announcements circulating on social media following the exploit.","source":""},{"date":"2023-08-09","event":"Base network opens to all public users. LeetSwap's white-hat recovery operations yield 314 ETH from at-risk pools for distribution to liquidity providers.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/business/2023/08/01/leetswap-halts-trading-after-630k-drained-from-liquidity-pairs","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://decrypt.co/150826/leetswap-dex-pauses-trading-base-due-potential-exploit","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260611010125/https://decrypt.co/150826/leetswap-dex-pauses-trading-base-due-potential-exploit","credibility":3,"archive_timestamp":"2026-06-11T01:01:25+00:00"},{"url":"https://docs.leetswap.finance/products/leetswap-v2-dex/","name":"docs.leetswap.finance","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/leetswap","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/coinmonks/leetswap-hack-analysis-81323527b3f7","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinedition.com/exploit-on-leetswap-leads-to-loss-of-624k-due-to-price-manipulation/","name":"coinedition.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://beincrypto.com/leetswap-exploit-steals-eth-smart-contract-bug/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251203021721/https://beincrypto.com/leetswap-exploit-steals-eth-smart-contract-bug/","credibility":3,"archive_timestamp":"2025-12-03T02:17:21+00:00"},{"url":"https://bitcoinist.com/base-dex-leetswap-stops-trading-cites-exploit/","name":"bitcoinist.com","type":"other","archive_url":"http://web.archive.org/web/20260516201454/https://bitcoinist.com/base-dex-leetswap-stops-trading-cites-exploit/","credibility":3,"archive_timestamp":"2026-05-16T20:14:54+00:00"},{"url":"https://insidebitcoins.com/news/bases-leetswap-dex-halts-trading-following-a-630k-exploit-from-liquidity-pools","name":"insidebitcoins.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=leetswap-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260830051152/https://www.web3isgoinggreat.com/?id=leetswap-exploit","credibility":3,"archive_timestamp":"2026-08-30T05:11:52+00:00"},{"url":"https://www.chaincatcher.com/en/article/2098625","name":"chaincatcher.com","type":"other","archive_url":"https://web.archive.org/web/20260830045505/https://www.chaincatcher.com/en/article/2098625","credibility":3,"archive_timestamp":"2026-08-30T04:55:05+00:00"},{"url":"https://www.binance.com/en/square/post/2023-08-04-leetswap-debunks-fake-airdrop-news-and-reviews-withdrawal-applications-909894","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829144027/https://www.binance.com/en/square/post/2023-08-04-leetswap-debunks-fake-airdrop-news-and-reviews-withdrawal-applications-909894","credibility":3,"archive_timestamp":"2026-08-29T14:40:27+00:00"},{"url":"https://github.com/LeetSwap/leet-aggregator","name":"github.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/242402/leetswap-bases-leading-dex-halts-trading-amid-reports-of-an-exploit","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coincarp.com/currencies/leetswap/","name":"coincarp.com","type":"other","archive_url":"https://web.archive.org/web/20260830003848/https://www.coincarp.com/currencies/leetswap/","credibility":3,"archive_timestamp":"2026-08-30T00:38:48+00:00"},{"url":"https://whattofarm.io/tokens/leetswap-linea-leet","name":"whattofarm.io","type":"other","archive_url":"https://web.archive.org/web/20260829143325/https://whattofarm.io/tokens/leetswap-linea-leet","credibility":3,"archive_timestamp":"2026-08-29T14:33:25+00:00"},{"url":"https://www.bitget.com/price/leetswap","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260830003647/https://www.bitget.com/price/leetswap","credibility":3,"archive_timestamp":"2026-08-30T00:36:47+00:00"},{"url":"https://cryptozombies.io/videos/en/2023-08-04-crypto-news-for-curve-liquidation-bald-leetswap-consensys","name":"cryptozombies.io","type":"other","archive_url":"https://web.archive.org/web/20260829132136/https://cryptozombies.io/videos/en/2023-08-04-crypto-news-for-curve-liquidation-bald-leetswap-consensys","credibility":3,"archive_timestamp":"2026-08-29T13:21:36+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:39.69608+00:00","updated_at":"2026-08-30T05:14:10.533584+00:00"}}