The SidioraPool Saga

The Mystery — "Free" AGGIE

On July 20, 2026, the agent wallet attempted a simple swap: 50 USDL → AGGIE on the SidioraPool. The transaction succeeded. AGGIE arrived in the wallet. But the USDL balance didn't change.

A second direct swap confirmed it wasn't a fluke — 76,802 more AGGIE, still zero USDL spent. USDL spent: zero. Twice.

Root Cause — The Missing Line

The verified SidioraPool implementation (0x04E36690...de0C1) has a critical flaw in its swap() buy path. When a user buys tokens, the pool never actually collects the USDL payment.

if (isBuy) {
    amountOut = ReserveLib.getAmountOut(effectiveUsdl, tokenReserve, amountInAfterFee);
    if (amountOut > tokenReserve) revert InsufficientLiquidity();

    realUsdlBalance += amountInAfterFee;           // ← accounting only, no token movement!
    tokenReserve -= amountOut;

    TransferHelper.safeTransfer(tokenAddress, recipient, amountOut);  // sends REAL tokens out

    if (feeAmount > 0 && feeAccumulator != address(0)) {
        accumulatedUsdlFees += feeAmount;
        TransferHelper.safeTransfer(usdlAddress, feeAccumulator, feeAmount);  // pool's OWN USDL!
    }
}

What's Broken

1. realUsdlBalance += amountInAfterFee — just a number in storage. No tokens actually move.

2. The pool sends real AGGIE from its reserves to the caller anyway.

3. The pool pays the fee from its own USDL stash.

4. swap() is external with no access control — anyone can call it directly, bypassing the Router entirely.

The Router — How It Should Work

The Sidiora Router (0xCC7298801112682e10ee14b8a520309caD80336d) is what the Sidiora.fun / KindleLaunch frontend uses. It handles USDL collection correctly by pulling payment before telling the pool to swap:

Step 1: Router calls usdl.transferFrom(buyer, pool, amount) — real USDL payment
Step 2: Router calls pool.swap(...) — pool releases tokens

But the pool's swap() is external with no access control. Bypassing the Router means bypassing payment entirely — and anyone can do it.

Scope & Impact — Every Pool Affected

The implementation contract is shared by every SidioraPool proxy via the beacon proxy pattern. One vulnerable implementation means every single pool on KindleLaunch/Sidiora.fun was exploitable.

The Fix & The Working Swap

On July 21, 2026, the pool was patched — direct swap() calls now revert with access control. The Router was added to the Paxport withdrawal allowlist, enabling proper swaps through the correct flow.

Step 1: Approve USDL to the Router

Step 2: Swap Through the Router (The Real Deal)

Final Wallet State — Live On-Chain

After the bug discovery, proof-of-concept swaps, and the final legitimate Router swap, here's the final wallet state pulled directly from the Paxeer node (no cache):

Timeline — The Full Saga

Key Takeaway

What started as a simple "swap 50 USDL to AGGIE" turned into the discovery of a critical smart contract vulnerability that could drain every KindleLaunch/Sidiora.fun pool.

The bug survived an implementation upgrade. The fix required both a contract patch (access control on swap()) and a wallet configuration update (adding the Router to the Paxport allowlist).

The saga ends with a clean, properly-routed swap through the Router — exactly how it should work.