A business logic flaw in SynapLogic's referral system allowed attackers to mint 144k SYP tokens without proper validation. The exploit involved 193 suspicious transactions where attackers repeatedly called the referral function with flashloan-backed ETH, receiving 10% referral rewards for each fraudulent transaction.

According to a BlockSec alert, the SynapLogic contract lacked critical parameter validation in the swapExactTokensForETHSupportingFeeOnTransferTokens function, allowing attackers to manipulate the whitelist logic and designate arbitrary recipient addresses. In addition, the contract failed to verify whether the total amount of native tokens distributed exceeded the actual payment made, enabling attackers to withdraw excess native tokens while simultaneously receiving newly minted SYP, resulting in losses of approximately $186,000.