# TesseraSwap: callback repayment price spread drains treasury

TesseraSwap sent USDC to attacker before collecting owed WETH, letting attacker buy WETH externally and repay, keeping the spread.

- Payout: Real-world hack
- Severity: high
- Program: TesseraSwap
- Credited: DeFiHackLabs
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/TesseraSwap_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260518-tesseraswap
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained vuln:business-logic

**Target:** DEX swap contract with callback
**Root cause:** TesseraSwap transferred output tokens (USDC) to the recipient before collecting input tokens (WETH) in the callback, allowing the attacker to use the received USDC to source the owed WETH externally at a better price.
**Steps:**
1. Call `tesseraSwapWithCallback(WETH, USDC, amountIn, 0, attacker, '', '')` with a small WETH amount.
2. In `tesseraSwapCallback`, receive USDC from TesseraSwap.
3. Use part of the USDC to swap for exactly `amountIn` WETH on a WETH/USDC pool (e.g., PancakeV3) with a permissive price limit.
4. Transfer the acquired WETH back to TesseraSwap to satisfy the callback.
5. Repeat 100 times to accumulate profit; transfer USDC profit to attacker.
**Exploitation:** Attacker repeatedly invoked TesseraSwap's callback-based swap, receiving USDC upfront. They used the USDC to buy the owed WETH on an external pool at a favorable price, repaid TesseraSwap, and kept the remaining USDC as profit. Looped 100 times for ~$20K total.
**Escalation:** Looping the swap 100 times amplified the per-swap spread into a ~$20K profit.
**Insight:** When a contract sends output tokens before collecting input tokens in a callback, check if the received output can be used to source the owed input externally at a better price, especially if the callback allows arbitrary external calls.