DaoSwap's reward system had a flaw allowing users to set themselves as their own inviter. Attackers exploited this access control vulnerability to gain unauthorized mining rewards by claiming referral bonuses.

On September 5th, DaoSwap lost 580,000 USDT in an attack that allowed users to set the inviter’s address as themselves due to mining rewards that were larger than the fees charged during the swap process and lack of verification.