注册并分享邀请链接,可获得视频播放与邀请奖励。

GoPlus Security 🚦
@GoPlusSecurity
Protect Your Every Transaction. User App: 🛡️ Dev Integration: Security Intelligence & SafeToken Protocol 🛡️
加入 May 2021
1.1K 正在关注    420.3K 粉丝
🚨 UNCX Vesting V2 exploit breakdown: ~$1.5M drained across 4 chains On Oct 14, @UNCX_token Vesting V2 was exploited on Ethereum, BNB Chain, Base, and Robinhood Chain. About $1.5M in total. LP locks and legacy Vesting contracts were not affected. UNCX has put containment in place: higher fees, tighter fee-exemption rules. Affected projects and users should watch the official follow-up on remediation and recovery. 🔍 Root cause: share-accounting bug A flaw in `VestingManager`. The same shares were deducted again by `cancel()` after `release()`, so total shares in the shared pool were over-reduced. Remaining small positions then had outsized withdrawal power. How it worked: - `release()` paid out by a position’s share of the pool, then reduced the pool’s total shares. - A top-up lock minted new shares at the then conversion rate and updated the position’s nominal locked amount. - `cancel()` recalculated vested shares from that updated amount, without covering shares already released. Refunds used the nominal token amount. 📍 Affected Vesting V2 contracts Ethereum `0xa98f06312b7614523d0f5e725e15fd20fb1b99f5` BNB Chain `0x7f3f9f4ed8987b78adc448a840169a0fd5affaab` Base `0x7ca3de7d58a0bcad115184597553485a919320c5` Robinhood Chain `0xb31eaefa2a0bdc53df6d7a7f0f289b6ee1a8aaf3` 🔎 Addresses identified Attacker `0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3` Funded with 3.5 ETH before the exploit by `0x6D2Afff4Fc6FF46564467762c4aA35812680D606` Attack contract `0x6cebdf095172b355121b93962017975c4601f26c` Profit-receiving contract `0xf6d072254eb8a9b06e0ba21221b498332c1bc35e` Copycat attackers and MEV bots also joined in. Follow-on exploits showed up on all four chains. These addresses are not the full set. Sample tx
显示更多
UNCX Vesting V2: Security Incident Update Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next. 1. Security measures and containment We have implemented several measures to prevent further exploitation of the affected contracts: > Introduced substantial flat fees exceeding 1,000 ETH per lock. > Removed all clients and contract interactions that previously allowed these fees to be bypassed. > Increased token fees to the maximum permitted by the Vesting V2 contracts (5%), making repeated vesting top-ups economically unviable. These measures are designed to prevent further exploitation through the identified methods. While our investigation and monitoring remain ongoing, we firmly believe we have taken the necessary steps available to us to contain the incident. 2. Scope of the incident As previously communicated, all LP lockers remain unaffected, across every protocol and chain supported by UNCX. The incident is isolated to UNCX Vesting V2. Our legacy vesting contracts are also unaffected and have undergone additional checks and review. The incident currently involves 10 tokens across 4 chains: Ethereum (6): $pepecoin, $EDGEN, $ZC, $X, $LO0P, $PAAL Base (1): $IMO BNB Chain (1): $BTCLE Robinhood Chain (2): $CASHCAT, $RKST 3. Next steps for affected projects and communities We are already in contact with most of the affected teams, communities or individuals impacted. We expect to share further guidance and next steps with affected teams this week. We will also publish a comprehensive incident report covering the technical findings, financials, and the details of our proposed recovery plan. Important: For all impacted tokens, we strongly advise against trading in the affected pools until further guidance is provided by the respective token teams. We will be coordinating directly with those teams over the coming days. 4. Investigation and recovery efforts Our investigation remains active, and we are coordinating with law enforcement and @seal911. To date, no funds have been returned by the attackers (primary and copycats) on any affected chain. We strongly encourage the responsible party to contact us directly to discuss a resolution. We understand the seriousness of this incident for affected projects, holders, and communities. Our immediate priorities remain preventing further exploitation, establishing the full extent of the impact, and working closely with affected teams toward a recovery plan. We will continue to communicate when any meaningful updates become available. Thank you for your patience. The UNCX Team
显示更多