UNCX Network’s Vesting V2 smart contract suffered an exploit that drained between $1.49 million and $1.5 million across four blockchains. The losses occurred across Ethereum, BNB Chain, Base, and Robinhood Chain. The incident stemmed from a mathematical logic flaw within the contract code rather than a private key compromise.
How the Share-Accounting Flaw Occurred
Immunefi’s Head of Security, Gonçalo Magalhães, revealed that the exploit was rooted in a share-accounting flaw within the smart contract. The issue surfaced when users withdrew vested tokens and subsequently canceled their positions.
The vulnerability began in the release function, which allows recipients to claim tokens according to their vesting schedule. However, the function failed to deduct the withdrawn shares from the position counter. The system continued to record an intact share balance even though tokens had already left the contract.
The accounting breakdown occurred when the cancellation function was called next. The system read the unreduced value and subtracted the unvested portion again. This sequence broke the pool’s global total shares invariant. The pool’s remaining share value inflated beyond real figures, allowing the attacker to withdraw tokens far exceeding their legitimate entitlement.
Three Vesting Positions and the MEV Bot Rush
Gonçalo Magalhães detailed the attacker’s scheme when exploiting the vulnerability. The hacker opened three vesting positions simultaneously within the system. The attacker then deliberately sacrificed two positions through withdrawal and cancellation cycles. This corrupted the pool balance to the point that the single remaining position was entitled to withdraw massive profits.
Security analytics firm Blockaid noted that the $1.49 million loss was split across 11 drain transactions on Ethereum, BNB Chain, Base, and Robinhood Chain. However, the initial hacker was not the only actor extracting funds.
The 11 drain transactions also involved copycat wallets and MEV bots. As soon as the first exploit appeared in the public mempool queue, automated bots immediately copied the transactions, racing to drain the remaining balances across multiple chains.
Lessons from the Absence of Global Balance Guards
Magalhães emphasized that the fundamental failure of UNCX’s smart contract was the absence of internal safeguards. The contract lacked a verification mechanism to ensure that every function maintained the accuracy of the global shares counter. The lack of these guardrails allowed corrupted balances to be processed until funds were drained.
For protocol developers and vesting token holders, the UNCX incident proves that code audits must thoroughly test the integrity of cross-function interactions. When mathematical invariants break down in an open mempool, competitive bots need only seconds to sweep up the remaining funds.
Dilansir dari crypto.news.
Baca juga: What Is DeFi (Decentralized Finance)?
Baca juga: Exchange Founded by Ex-Binance Futures Chief Shuts Down - 237,000 Users Shifted to DUSD Airdrop
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
