UNCX exploit reveals critical share-accounting flaw

The exploit originated in the contract’s release function, which failed to subtract withdrawn tokens from the total share counter. When users canceled positions, the contract read the original, unadjusted value and subtracted the unvested portion again. This discrepancy artificially inflated the value of remaining shares, enabling attackers to drain more assets than their actual holdings permitted. By sacrificing specific positions, exploiters created a massive profit margin for their remaining stakes.

Investigations into the incident involve distinguishing the original attacker from copycat wallets and MEV bots by analyzing transaction sequences. Magalhães noted that while early movers often signal the primary actor, the line between original exploiters and opportunistic copycats frequently blurs. Recovering these funds often requires direct engagement with bot operators or protocol teams.

Addressing the broader implications for decentralized finance, Magalhães emphasized that projects bear shared responsibility alongside infrastructure providers for user reimbursement. He advised that teams must conduct independent technical reviews of any third-party vesting services rather than relying solely on provider reputation. UNCX has since coordinated with law enforcement and the SEAL 911 team, signaling that its liquidity lockers and legacy contracts remain outside the scope of the vulnerability.