# BeatXswap vesting: slot0 oracle manipulation drains BTX reserves

BeatXswap vesting contracts priced BTX off a single PancakeSwap V3 slot0 read; attacker crashed spot price and drained ~2.98M BTX for ~$63.7K profit.

- Payout: Real-world hack
- Severity: high
- Program: BeatXswap
- Disclosed: 2026-09-09
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/BeatXswap_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260909-beatxswap
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** LiquidityVestingConvert / LiquidityVestingConvertOnce deposit() on BNB Chain
**Root cause:** deposit() is permissionless and prices BTX from a single PancakeSwap V3 slot0().sqrtPriceX96 read with no TWAP or deviation guard; the 3% slippage check validates against the already-manipulated quote, and the BTX leg is sized off the full quote while only 25% of USDT reaches the LP.
**Steps:**
1. Flash-borrow 15,950 USDT from Moolah.
2. Inside Pancake Infinity Vault lock, take 6,000,000 BTX flash.
3. Dump BTX into V3 pool 0xA5Db... (zeroForOne=false) to crash sqrtPriceX96.
4. Call VICTIM1.deposit(10,000e18) — mints LP at crashed tick using ~1.24M BTX of contract reserves.
5. Dump more BTX, call VICTIM2.deposit(2,000e18) — pulls ~1.83M BTX.
6. Reverse swap to buy BTX back, sweeping victim-added liquidity.
7. Repay 6M BTX to Vault; sell ~2.98M BTX on Pancake Infinity CL pool for ~77,512 USDT; repay Moolah; keep ~63,704 USDT.
**How found:** Source review of verified vesting contracts revealed deposit() reads slot0().sqrtPriceX96 directly with no TWAP and a slippage bound derived from the same manipulated quote, making the oracle trivially manipulable via a flash-funded swap.
**Exploitation:** Flash loans (Moolah USDT + Infinity Vault BTX) fund a spot-price crash on the V3 oracle pool; permissionless deposit() then mints LP positions pairing tiny USDT with the vesting contracts' own BTX reserves at the manipulated tick; attacker restores price, repays flash loans, and resells drained BTX on an unmanipulated CL pool for net ~$63.7K.
**Escalation:** Chained two vesting contracts (VestingConvert and VestingConvertOnce) with successive price pushes to drain both reserves in one transaction.
**Insight:** When a contract's slippage check is computed from the same spot read it is trying to protect against, the guard is circular — look for amountMin derived from slot0 rather than an independent oracle, and check whether the priced leg is sized off the full quote while only a fraction of input reaches the pool.