🚨 Exploit Alert — Ethereum ~10.7 ETH was drained from two legacy Visor/Gamma FLOAT-ETH Hypervisor vaults via a flash-loan price manipulation. 🔍 Root cause: the Hypervisor mints LP shares in deposit() off the Uniswap V3 pool's INSTANTANEOUS spot price (currentTick()/slot0) with no TWAP and no spot-vs-oracle deviation check — while withdraw() redeems shares for a proportional slice of the real underlying tokens. Minting is spot-priced, redemption is not. Move the spot price and deposit→withdraw becomes a net drain. Deposits are permissionless (whitelist disabled). 🧾 On-chain: Attacker: 0xaea29218262dc6b0904ca077f6527c49dfd426d9 Contract: 0x05303c95ee7ff76daf1421b28e024635d7fe51ab Vaults: 0x85cbed52…a8a70c · 0xc86b1e7f…c1153 Tx: 0x3d7549db65344da2a41067e17791b17fac16ec6b8e5132e82e243f6541de5cff Block: 25874402 · 2026-08-31