# NST Simple Swap: wrong approval enables $40k drain

Unverified NST swap contract on Polygon had wrong approval logic, letting attacker flash-loan USDT, buy NST, sell back, and drain $40k.

- Payout: Real-world hack
- Severity: high
- Program: NST Simple Swap
- Analysis by: DeFiHackLabs
- Disclosed: 2023-06-02
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-06/NST_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230602-nst
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:access-control vuln:business-logic

**Target:** Polygon swap contract (unverified)
**Root cause:** The swap contract's approval logic was incorrect, allowing an attacker to manipulate the buy/sell flow and extract USDT.
**Steps:**
1. Flash-loan 40,000 USDT (mocked in PoC).
2. Approve swapper contract for max USDT and NST.
3. Call swapper with selector `0x6e41592c` and 40,000,000,000 (40k USDT) to buy NST.
4. Call swapper with selector `0x7cd0599b` passing the received NST amount to sell NST back.
5. Transfer 31,559,083,207 USDT from swapper to attacker, netting ~$31.5k profit.
**How found:** Researcher analyzed the unverified swap contract and identified flawed approval logic enabling the buy/sell cycle to extract funds.
**Exploitation:** Attacker flash-loaned 40k USDT, bought NST via the swap contract, then sold the NST back, exploiting wrong approval to drain 31.5k USDT from the contract.
**Insight:** Unverified contracts with custom swap logic often have approval bugs; always check if the contract grants excessive allowances or mishandles token transfers during buy/sell operations.