Cryptobottle's swap contract was exploited by disabling balance checks after callback, allowing arbitrary swaps that manipulated NAS token price and drained $490K in USDT to the attacker's address.

In October 2024, Cryptobottle on Polygon suffered three separate attacks, with total losses amounting to approximately $527,000. The attack on October 24 was the largest of the three, where the attacker exploited a critical vulnerability to disable the balance check in the swap() method after a callback. This allowed them to make arbitrary swaps to acquire a large amount of NAS tokens, which they then sold, resulting in a loss of around $490,000 for the project.