The Internet Token’s privileged LiquidityUnifier contract had INT minting authority and exposed a permissionless swapV3(token, pool) function accepting a caller-supplied pool. Its validation only required the supplied address to contain code, not be excluded, and report INT and the requested token through token0()/token1(). The attacker supplied a malicious fake pool satisfying these checks. swapV3() stored that address as currentPoolV3 and called its swap(), allowing the fake pool to invoke uniswapV3SwapCallback() with an attacker-selected amount. Because the callback trusted currentPoolV3, it caused the privileged contract to mint INT to the fake pool. The attacker bypassed the surrounding supply-increase check by converting the newly minted INT through the project’s Convertor during the call, reducing supply before the check, and converting it back afterward. Approximately 161.3M counterfeit INT was then sold into the genuine INT/WETH pool for 5.85 WETH