# Ambient CrocSwapDex: native surplus accounting drained via tick walking

Ambient CrocSwapDex native ETH surplus accounting flaw let attacker flash-loan WETH, deposit as native surplus, walk pool ticks, and drain ~67.85 ETH.

- Payout: Real-world hack
- Severity: high
- Program: AmbientCrocSwapDex
- Credited: DeFiHackLabs
- Disclosed: 2026-06-07
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AmbientCrocSwapDex_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260607-ambientcrocswapdex
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** DEX AMM (CrocSwapDex) native surplus accounting
**Root cause:** Native ETH surplus deposited via ColdPath command 73 is tracked separately from pool reserves; walking the pool tick and minting/harvesting a narrow range lets the attacker disburse surplus (command 74) that exceeds what they contributed.
**Steps:**
1. Flash-loan 50 WETH + 1 USDC from Balancer Vault
2. Unwrap WETH to ETH and call `userCmd(3, abi.encode(uint8(73), attacker, uint128(50e18), address(0)))` to deposit native surplus
3. Loop `hotSwap(poolIdx=420, true, true, 1e30, nextTick.getSqrtRatioAtTick(), 1)` 13 times stepping tick by 800 to walk pool up
4. Mint narrow range at `currentTick+3` to `+35` via `warmRange(poolIdx, 1, 19111745536, bid, ask)`
5. Nudge with `hotSwap` to `currentTick+19` then `warmRange(poolIdx, 5, 0, bid, ask)` to harvest
6. Swap back to startTick, then `userCmd(3, abi.encode(uint8(74), attacker, int128(0), address(0)))` to disburse all native surplus
7. Wrap ETH to WETH and repay Balancer; forward ~67.85 ETH profit
**How found:** Likely source review of CrocSwapDex ColdPath command handlers (73 deposit / 74 disburse native surplus) revealing surplus is not reconciled against pool reserves, then modeling tick-walk + narrow-range mint/harvest to inflate disbursable surplus.
**Exploitation:** Flash loan provides capital; attacker deposits WETH as native surplus, manipulates pool tick via repeated hotSwaps, mints/harvests a narrow range to accrue surplus, then disburses the entire native surplus balance via command 74 and repays the loan, netting ~67.85 ETH.
**Insight:** In AMMs with separate native-token surplus accounting, check whether deposit/disburse commands reconcile against pool reserves; tick-walking plus narrow-range mint/harvest can inflate the surplus ledger independently of swap PnL.