Float Protocol suffered a flash loan attack that caused losses of about $28,000, or 10.71 ETH, according to monitoring data cited by ChainCatcher from blockchain security firm SlowMist. The attacker manipulated the Uniswap V3 spot price, specifically slot0, which led to incorrect LP share pricing in the protocol’s Hypervisor contract. SlowMist said the issue was tied to key functions that lacked TWAP or oracle validation as well as slippage protection. The attacker then carried out large trades in a V3 pool to distort the values returned by currentTick() and getTotalAmounts(). After pushing share valuations higher, the attacker repeatedly deposited and withdrew to extract profit. The report focuses on the attack path and the pricing weakness involved in the exploit.
Float Protocol suffered a flash loan attack that resulted in losses of about $28,000, or 10.71 ETH, according to SlowMist monitoring cited by ChainCatcher.
SlowMist said the attacker manipulated the Uniswap V3 spot price, or slot0, which caused incorrect pricing of LP shares in the Hypervisor contract. The key functions involved did not have TWAP or oracle checks, and they also lacked slippage protection.
According to the attack description, the exploiter used large trades in a V3 pool to distort the values of currentTick() and getTotalAmounts(). The attacker then repeatedly deposited and withdrew against the inflated share value to capture arbitrage profit.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
