CryptoBottle Incident Analysis

In October 2024 CryptoBottle on Polygon was exploited in three incidents totaling about $527K, with the largest on 24 October where an attacker abused a vulnerability that disabled the post-callback balance check in swap() and misused a publicly controllable fixedPriceEnabled flag to mint and swap large amounts of NAS for USDT, draining roughly $490K. The report details the attack flow, affected contracts and addresses, fund movements, and recommends regular smart-contract audits.