# Kipseli PropAMM: decimals mismatch inflates cbBTC swap output

Kipseli PropAMM quote returned USDC-scale amount for WETH->cbBTC swap, but swap transferred that integer as cbBTC units, letting attacker drain 0.93 cbBTC for 0.04 WETH.

- Payout: Real-world hack
- Severity: high
- Program: KipseliPropAMM
- Credited: DeFiHackLabs
- Disclosed: 2026-04-21
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/KipseliPropAMM_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260421-kipselipropamm
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:business-logic vuln:precision-loss

**Target:** PropAMMWrapper swap/quote functions on Base
**Root cause:** The quote function returned an amount denominated in USDC (6 decimals) for a cbBTC (8 decimals) output token, and the swap function used that integer directly as cbBTC units without decimal normalization.
**Steps:**
1. Attacker wraps 0.04 ETH into WETH and approves PropAMMWrapper.
2. Calls `wrapper.quote(WETH, 0.04e18, cbBTC)` which returns ~92e6 (USDC-scale).
3. Calls `wrapper.swap(WETH, 0.04e18, cbBTC, 1, attacker)` with minOutAmount=1.
4. Wrapper transfers ~92e6 cbBTC units (0.92 cbBTC) to attacker, draining from its cbBTC balance.
5. Attacker forwards cbBTC to profit receiver.
**How found:** Likely spotted that quote output for a WETH->cbBTC route was orders of magnitude larger than expected for cbBTC's 8 decimals, indicating a decimal mismatch between quote and settlement.
**Exploitation:** Attacker used a flash-loan-free 0.04 WETH to call swap; the wrapper's quote returned a USDC-scale integer (~92e6) which was then transferred as cbBTC units (8 decimals), yielding ~0.926 cbBTC. The wrapper's cbBTC balance was drained.
**Insight:** When a protocol quotes one token but settles another, check decimal normalization: a quote in 6-decimal USDC units used as 8-decimal cbBTC units inflates output by 100x. Test cross-decimal routes with small inputs and compare quote scale to token decimals.