SlowMist(@SlowMist_Team):🚨SlowMist TI Alert🚨 💸 @usmfum Loss: ~70.83 ETH 🔍 Root Cause: Pricing logic flaw in `ethFromDefund()` of USM's `defund()` function. The function uses arithmetic mean of current and estimated final FUM sell prices for single redemptions, but lacks "split invariance." Combined with per-redemption state contraction (`adjShrinkFactor`) and integer rounding, 64 small `defund()` calls return more ETH than one large call for the same FUM amount. - Attacker EOA: `0xb92b2e47680c89da8f951b8963ef469f461a50fc` - Attacker Contract: `0x5a5e29ba89663a3558273354e990426f3cac7de7` - Victim Contract (USM): `0x2a7fff44c19f39468064ab5e5c304de01d591675` - Profit Receiver: `0xe3c6346b6f282029312d2caf4677ef39beabbf99` Powered by https://t.co/Mz5jOnx997 Tx:

2026.08.10 02:44

🚨SlowMist TI Alert🚨 💸 @usmfum Loss: ~70.83 ETH 🔍 Root Cause: Pricing logic flaw in `ethFromDefund()` of USM's `defund()` function. The function uses arithmetic mean of current and estimated final FUM sell prices for single redemptions, but lacks "split invariance." Combined with per-redemption state contraction (`adjShrinkFactor`) and integer rounding, 64 small `defund()` calls return more ETH than one large call for the same FUM amount. - Attacker EOA: `0xb92b2e47680c89da8f951b8963ef469f461a50fc` - Attacker Contract: `0x5a5e29ba89663a3558273354e990426f3cac7de7` - Victim Contract (USM): `0x2a7fff44c19f39468064ab5e5c304de01d591675` - Profit Receiver: `0xe3c6346b6f282029312d2caf4677ef39beabbf99` Powered by Tx: