UNCX’s Vesting V2 exploit has exposed a share-accounting flaw that let attackers inflate their claims on pooled tokens, Immunefi’s security chief has explained following reports of roughly $1.5 million drained across four chains.
Summary
- Withdrawal and cancellation functions left share accounting out of balance, according to Magalhães.
- Reported losses reached roughly $1.5 million across four networks, with copycat wallets and bots involved.
- Magalhães advised private contact with affected teams before public withdrawal warnings when possible.
- Providers and affected projects share responsibility for working toward reimbursement, he said.
Gonçalo Magalhães, head of security at Immunefi, told crypto.news that the contract failed to keep its share counters consistent when users withdrew vested tokens and canceled positions.
UNCX withdrawals left a stale share count
In Magalhães’s account, the weakness began with the contract’s release function, which lets a beneficiary withdraw tokens that have become available under a vesting schedule.
After a withdrawal, the function failed to subtract the released shares from the position’s counter, he said. When the cancellation function subsequently read that unchanged value, it subtracted the unvested portion again, distorting the pool’s accounting.
According to the security chief, the combination inflated the value assigned to the remaining shares. An attacker could then use a position left in the pool to withdraw more tokens than it should have received.
Describing one attack, Magalhães said the exploiter opened three vesting positions and sacrificed two through the withdrawal and cancellation functions. The remaining position became eligible for a withdrawal carrying what he described as a “massive profit.”
He identified the central failure as the absence of a consistent accounting rule across the contract’s functions.
“Ultimately, the smart contract failed to make sure that no functions could break the invariant around the shares’ global counter.”
His explanation places the weakness in how the functions updated and reused share balances. The safeguard he identified was a rule ensuring that every operation preserved the accuracy of the total share count.
The Crypto Times reported on Oct. 15 that Blockaid had estimated losses at approximately $1.49 million across Ethereum, BNB Chain, Base and Robinhood Chain. Its account attributed 11 drain transactions to activity involving the original attacker, copycat wallets, and maximal extractable value, or MEV, bots.
Private intervention comes before public warnings
Asked how security firms should respond when an exploit remains active, Magalhães said the available response depends on the protocol and the people who can intervene.
His first recommendation was to contact the affected team privately because operators may have a way to pause activity and stop further exploitation.
Where that route is unavailable, he said a security firm could try contacting publicly identifiable large depositors. A public warning urging withdrawals becomes the remaining option once other avenues have been exhausted.
“Once all options are exhausted, there’s little to be done other than to publicly call on users to withdraw their funds immediately.”
Magalhães did not present a single disclosure schedule suitable for every incident. His response instead described a sequence of possible interventions, beginning with people who might be able to halt the attack or remove exposed deposits.
An Oct. 6 account of an unidentified Base vault described a separate obstacle to private intervention. In that case, Magalhães said a researcher faced legal uncertainty because the vault’s operators were unidentified and there was no clear disclosure channel. The incident briefing put the theft at roughly $6 million.
Wallet histories help investigators separate participants
For investigators examining UNCX, Magalhães said transaction histories provide a starting point for distinguishing the original exploiter from other participants.
The person who first deployed the attack generally appears among the earliest movers, he said. Established users have records of earlier interactions with the protocol, while automated trading wallets may show a history consistent with bot activity.
Investigators can compare later transactions with the sequence used by the original attacker, according to Magalhães. A previous customer could still have copied the exploit, so an existing relationship with the protocol does not settle the question.
“Ultimately, the line gets fuzzy and hard to draw.”
When bots receive funds, he said investigators must contact their operators to seek a return.
A separate Sept. 15 incident involving 2,900 rsETH on Ethereum illustrates why investigators examine transaction ordering. Security researchers said the Yoink bot executed ahead of the suspected attacker in the same block, while the original exploit transaction failed. The bot received assets valued at approximately $7.8 million at the time.
On recovery negotiations, Immunefi CEO Mitchell Amador took a different question of authorization into account in comments on Liquid Network published Sept. 21. He said researchers should use private disclosure channels and agreed bounty terms instead of taking user assets and setting a reward afterward.
Providers and projects should work toward reimbursement
Asked about projects whose tokens were held in shared vesting infrastructure, Magalhães said teams should have their own security personnel examine any provider they adopt.
A provider’s reputation forms part of that assessment, he said, but his recommendation placed technical review with the team choosing the infrastructure.
On responsibility after an exploit, Magalhães said both the provider responsible for the bug and the projects that selected it should work to make users whole.
“Responsibility for working to make users whole falls on both the provider with the bug and the projects that trusted said provider.”
His comments described responsibility for pursuing reimbursement, without setting a compensation formula or assigning a percentage of the losses to either side.
For auditors, Magalhães distinguished a missed vulnerability from a guarantee that reviewed code cannot fail. He said an audit service does not promise “fail-proof code.”
The Crypto Times reported that UNCX’s response included higher fees intended to discourage further exploitation and coordination with affected teams, law enforcement, and SEAL 911. According to that Oct. 15 account, UNCX said its liquidity lockers and legacy vesting contracts were unaffected and planned to publish technical findings and a proposed recovery plan.
