BeatXswap’s LiquidityVestingConvert contract used the live V3 pool slot0() price as its sole BTX pricing source, without a TWAP, deviation limit, or manipulation check. The attacker flash-borrowed BTX, dumped it into the BTX/USDT V3 pool to sharply reduce sqrtPriceX96, then deposited 10,000 USDT and 2,000 USDT into the vulnerable contracts. The manipulated quote caused the contracts to contribute an excessive amount of their own BTX when minting LP positions, allowing the attacker to extract the BTX before reversing the swaps and repaying the flash loans

BeatXswap’s LiquidityVestingConvert used the Uniswap/Pancake V3 slot0() spot price as its only oracle, with no TWAP or deviation checks. An attacker flash-loaned 6,000,000 BTX, dumped it to crash the pool price, then called deposit() twice (10,000 + 2,000 USDT) to mint LP at the manipulated quote and drain 2,984,557 BTX (~$77,512).