# OFFICIALYE swapper: public swapit() enables flash-loan sandwich

Public swapit() on an unverified Base swap helper let anyone force it to dump its own USDC into an Aerodrome pool, enabling a flash-loan sandwich for ~980 USDC profit.

- Payout: Real-world hack
- Severity: medium
- Program: unverified
- Credited: DeFiHackLabs
- Disclosed: 2025-03-06
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/unverified_de7c_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250306-unverified-de7c
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** Unverified Solidity swap helper contract on Base (swapit function)
**Root cause:** swapit() was externally callable with no access control and swapped the contract's own USDC balance through Aerodrome, letting any caller choose the timing and capture the resulting price impact.
**Steps:**
1. Flash-borrow 3,300 USDC from Morpho Blue.
2. Buy OFFICIALYE on the Aerodrome USDC/OFFICIALYE pool with borrowed USDC, pushing price up.
3. Call `swapit()` on 0xdE7CA40aE3C3430723A2d1E3AE0e6e27152744B0, forcing it to sell its own USDC into the same pool (price impact against the attacker's position).
4. Sell acquired OFFICIALYE back into the pool for USDC at the inflated price.
5. Repay Morpho flash loan and forward remaining USDC (~980) to attacker.
**How found:** Attacker likely noticed swapit() was unauthenticated and swapped the contract's own token balance through a public AMM pool, making it sandwichable by anyone who could call it.
**Exploitation:** Attacker flash-borrowed USDC via Morpho, front-ran the victim contract's own swap by buying OFFICIALYE first, triggered the public swapit() to make the contract dump USDC into the pool, then sold OFFICIALYE back at the depressed price, netting ~980 USDC after repaying the loan.
**Insight:** Look for externally callable functions on helper/router contracts that swap or move the contract's own token balance through a public AMM — these are free sandwich triggers because the caller controls timing and can pre-position around the forced swap.