🚨SlowMist TI Alert🚨 💸 @ArrakisFinance Loss: 2.94 WETH 🔍 Root Cause: The vault’s state-dependent Uniswap V3 mint/burn accounting was vulnerable to an atomic liquidity sandwich. The attacker minted shares against one pool composition, manipulated the price and accrued fees, then burned under the changed position state. burn() collected pending fees and distributed the corresponding liquidity, fees, and idle balances pro rata. The core issue was the lack of same-transaction mint–burn protection or state snapshot—not a standalone oracle manipulation or share over-minting bug. 📌 Attacker EOA: `0xa3b096e4df1247794599a37af8f5b8cb05d5eb44` 📌 Attack Contract: `0x028d9c17b1a097e7e115a6400203df86339baf4a` 📌 Vulnerable Vault (Proxy): `0x7c687f775a3b73bbab0e15832f24caab5d53bdde` 📌 Vulnerable Vault (Implementation): `0xd68b055fb444d136e3ac4df023f4c42334f06395` 📌 Manipulated Uni V3 Pool: `0xb9c4a5522a2f8ba9e2ff7063df8c02ed443337a3` 📌 Flash Loan Source (Morpho): `0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb` Powered by Tx: