mediumInteger overflow/underflowEVM-Solidity
BMX Deli Swap: Attacker can swap wBTC in the DeliHook multiples times to not pay / pay less swap fees
- Payout
- $0
- Protocol
- BMX Deli Swap
- Disclosed
- Sep 16, 2025
- Source
- sherlock
DeliHook's fee conversion for swappable tokens rounds the computed baseFeeSpecified down instead of up, so on small wBTC-amount swaps the fee truncates to zero wei, letting an attacker swap repeatedly without paying LP fees. Because wBTC has a high USD value p …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.