EtherVista’s EtherVistaPair.swap() contained an integer overflow vulnerability in its constant-product invariant check. Because the contract multiplied two uint112 reserves without sufficient overflow protection, the calculation could wrap around and incorrectly validate swaps that reduced the pool’s actual reserve product. An attacker registered a malicious contract as an authorized router and executed two crafted swaps to withdraw WETH and VISTA from the pool

EtherVista’s liquidity pool was exploited due to an integer overflow in the K-invariant check inside EtherVistaPair.swap(). Both reserves are uint112, so their product can wrap around and the check can pass even when the real reserve product drops sharply. The attacker registered a self-controlled contract as an authorized router and ran two crafted swaps to drain WETH and VISTA, with a loss of about $18,600.