Twenty-eight thousand dollars is not the kind of figure that usually stops a trading floor. In DeFi, though, a loss that size can still tell you everything about how a protocol thinks. Float Protocol just found that out the hard way. An attacker borrowed a pile of liquidity for a few seconds, shoved a Uniswap V3 pool off its normal tick, and walked out with about 10.71 ETH while the loan was repaid in the same breath. I have covered a lot of these incidents, and this one is almost painfully familiar. The money was small. The design mistake was not.
What Actually Happened To Float Protocol
On August 31, researchers flagged that Float Protocol had been drained of roughly $28,000. The path was not a mysterious zero-day in some exotic curve. It was a flash loan, a large swap, and a set of Hypervisor contracts that trusted the wrong number at the wrong moment. That number lived in Uniswap V3’s slot0, the compact snapshot that holds the current price and tick.
Once that snapshot moved, two functions started lying in a useful way. currentTick() no longer described a calm market. getTotalAmounts() no longer described honest inventory. Share math inside the vaults inflated. Deposit, withdraw, repeat. By the time the block settled, the attacker address 0xaea29218262dc6b0904ca077f6527c49dfd426d9 had finished the loop through attack contract 0xb46655eb5b77de277063a75586d1883e951b6c54.
Two contracts took the hit: 0x85cbed523459b7f6f81c11e710df969703a8a70c and 0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153. The underlying pool sat at 0xe8c2036068fc3b0161ee1def0e8d01df4eac0ac. Those strings look dry. They are the whole story. Code does not care about brand reputation. It cares about the last price it was allowed to read.
Why A Flash Loan Makes This Kind Of Move Cheap
A flash loan is not magic. It is a very strict IOU. You borrow a large amount with no collateral, you do whatever you want inside one transaction, and you pay it back plus a fee before the transaction ends. Miss the repayment and the chain pretends none of it happened. That rule is what makes the tool both useful and dangerous.
Traders use the same primitive for honest work. Collateral swaps. Liquidations. Tight arbitrage. The problem starts when a second contract treats a temporary pool state as if it were a fair market. I’ve found that teams still underestimate how little time an attacker needs. One block. Sometimes one atomic bundle. That is the entire window.
The loan is not the vulnerability. The loan is the budget. The vulnerability is the price the vault decided to believe.
In this case the budget was large enough to shove Uniswap V3 around. Concentrated liquidity makes that shove more precise than older constant-product pools. You do not always need to empty an entire reserve. You need to move the active tick far enough that the vault’s accounting flips in your favor. Then you stop being a trader and start being a customer of a confused share calculator.
Slot0 Is A Snapshot, Not A Verdict
Uniswap V3 keeps current price data in slot0. It is efficient. It is also the last print, not a debate among many prints. A whale-sized swap can change that print before any time-weighted average has a chance to catch up. If your vault reads that print and mints or burns shares from it, you have handed the attacker a lever.
That is exactly the pattern researchers described. Large swaps distorted the spot. currentTick() and getTotalAmounts() followed the distortion. Hypervisor logic priced LP shares as if the new tick were normal life. It was not normal life. It was a staged room.
Perhaps the most interesting aspect is how ordinary the missing defenses were. No TWAP check. No separate oracle. No serious slippage guard on the sensitive paths. Those are not exotic research ideas. They are the seatbelts people keep promising to install after the crash.
How Inflated LP Shares Turn Into Extracted Ether
Share accounting is supposed to be boring. You deposit assets. You receive a claim on the vault. You withdraw later against a fair claim. The whole machine assumes the inventory number and the price number are not being puppeteered in the same transaction that mints or burns the claim.
Break that assumption and the vault becomes an ATM with a sticky keypad. Deposit while shares are cheap relative to true value, or withdraw while shares are rich relative to true value. Do it more than once if the contract lets you. Researchers said the attacker did not take a single bite. The loop was the point.
- Move the Uniswap V3 spot with borrowed size.
- Let the Hypervisor read the bad tick and the bad totals.
- Deposit or withdraw against the inflated share price.
- Repeat while the pool is still off-center.
- Unwind the swap and repay the flash loan in the same transaction.
When the dust settled, the hole was about 10.71 ETH. At the time of the alert that printed near $28,000. Small by headline standards. Large enough if you were the liquidity sitting in those two contracts. Users do not experience “only twenty-eight thousand” as a rounding error when it is their stack.
The Addresses That Matter If You Are Cleaning Up
On-chain work is unforgiving in a useful way. You can argue about narratives. You cannot argue with the traces. For teams watching similar vaults, the identifiers are worth pinning to a board.
| Role | Address |
| Attacker wallet | 0xaea29218262dc6b0904ca077f6527c49dfd426d9 |
| Attack contract | 0xb46655eb5b77de277063a75586d1883e951b6c54 |
| Vulnerable contract A | 0x85cbed523459b7f6f81c11e710df969703a8a70c |
| Vulnerable contract B | 0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153 |
| Underlying V3 pool | 0xe8c2036068fc3b0161ee1def0e8d01df4eac0ac |
Copy them. Watch them. Compare your own vault’s read paths against the same pool family. If your code calls spot tick data in a function that also changes share supply, you are standing on the same rug pattern even if your brand is different.
This Is An Old Song With A New Chorus
Price manipulation through temporary liquidity is not a 2026 invention. It keeps coming back because protocols keep asking a pool for the truth at the exact moment an attacker can afford to lie. I still see pitch decks that treat a DEX spot as if it were a regulated feed. It is not. It is a market that can be leaned on if the lean is repaid before the block ends.
Other incidents this year followed the same family tree even when the brands and chains differed. One stablecoin routing design got knocked around after a large borrowed balance changed a pool ratio, then liquidity was pulled at the distorted rate. Another shop blamed off-chain price reports rather than on-chain math. A third mixed a flash loan with a leaked signer and bought tokens at a cartoon discount. Different doors. Same hallway.
Float Protocol’s case sits in the on-chain hallway. Researchers put the weakness inside the Hypervisor contracts themselves. The pool was used as a weapon. The vault was the target. That distinction matters when founders try to say “the market moved.” Markets move. Vaults are not supposed to treat a shove as a valuation.
TWAP, Oracles, And The Checks That Were Missing
A time-weighted average price is not poetry. It is a stubborn average. It looks at many observations instead of the last tick an attacker just bought. That stubbornness is the point. Spot can sprint. A decent TWAP jogs.
Does TWAP solve every fight? No. Long windows can lag a real crash. Short windows can still be pushed if someone is willing to pay for block after block. In my experience the useful design is layered. Spot for execution hints. TWAP or an external feed for share mint and burn. A hard cap on how far those two worlds are allowed to disagree. Slippage bounds so a function cannot settle against a fantasy inventory.
- Read a manipulation-resistant price for any action that changes share supply.
- Compare that price to spot and abort if the gap is absurd.
- Bound deposit and withdraw amounts so one loop cannot vacuum the vault.
- Make sensitive functions respect minimum output and maximum input.
- Simulate the attack path in tests with a flash-loan sized swap, not a polite 1% tick move.
None of that is glamorous. It also would have made this particular loop a lot less comfortable. The researchers were blunt: critical functions lacked TWAP or oracle validation and lacked slippage protection. That sentence should be taped above more than one GitHub repo.
Why Hypervisor-Style Vaults Are A Favorite Target
Active liquidity managers are trying to do a hard job. Uniswap V3 positions are not a simple coin pair sitting in a box. Ranges move. Fees accrue. Inventory on each side of the tick can look uneven even when nobody is attacking. A helper contract that reports “total amounts” is doing translation work. Translation is where bugs like to live.
If that helper trusts the current tick too much, the translation becomes a funhouse mirror. Shares are claims on a portfolio. Price the portfolio wrong and you mis-issue claims. Mis-issued claims are how value leaves the building without a dramatic reentrancy screenshot.
I keep coming back to a simple test I wish more auditors would force into every report. Can an attacker, inside one transaction, change the pool tick and then mint or redeem shares at a rate that was impossible one second earlier? If the answer is yes, you do not have a pricing model. You have a slot machine with a published payout table.
What Users Should Do When A Vault Relies On Spot
Most people will not read bytecode. Fair. You can still ask better questions before you park funds in a manager that sits on top of a volatile pool.
- Does the vault publish how it prices shares on deposit and withdraw?
- Is that price a spot tick, a TWAP, or a mix?
- Are there explicit slippage and share-inflation guards?
- Has anyone published a test that tries a flash-loan sized tick jump?
- How concentrated is the underlying V3 liquidity the vault depends on?
Thin liquidity is an attacker’s friend. A pool that looks deep on a calm Tuesday can still be cheap to move if most of the liquidity sits in a tight range. Concentrated liquidity is capital efficient for LPs. It is also capital efficient for people who want to rent a price for one transaction.
If a protocol cannot explain its pricing path in plain language, that is not a vibe issue. That is a risk issue. I’ve walked away from products that waved the question off with “we use Uniswap so the price is the market.” The market can be rented. Your withdrawal cannot.
The Uncomfortable Math Of “Small” Exploits
Twenty-eight thousand dollars will not trend next to nine-figure drains. That is precisely why it is worth sitting with. Small exploits are where sloppy patterns survive. They do not trigger emergency war rooms at every fund. They do not always force a full rewrite. They become footnotes. Footnotes get copied.
There is also a nasty incentive problem. An attacker who can reliably extract mid-five figures may keep the method quiet and farm it across copy-paste vaults. A researcher who discloses it gets a headline and a shrug. Guess which loop is easier to automate.
So no, I would not laugh this one off as “only 10.71 ETH.” The number is the receipt. The method is the product. If your codebase still treats slot0 as sacred during share math, you are selling the same product whether you know it or not.
Flash Loans Are Neutral. Your Assumptions Are Not.
People love to blame the loan primitive. That is lazy. Flash loans did not invent atomic composition. They made size cheap. If your contract cannot survive a world where anyone can rent size for one transaction, your contract is not ready for public liquidity. That is the adult version of the lesson.
Honest uses still matter. A borrower who refinances collateral in one click is not a villain. A keeper who liquidates a risky position with borrowed inventory is doing maintenance. The line is whether a second protocol treats the temporary world as permanent truth.
If repayment happens in the same transaction, the chain is fine. If your vault priced shares against a stage set, your users are not.
Float Protocol’s loss sits on that line. Borrow. Distort. Mint or burn against the distortion. Restore. Repay. The chain saw a balanced transaction. The vault saw a hole.
A Practical Checklist For Teams Shipping Vaults
If you maintain anything that issues shares against Uniswap V3 inventory, this is the unglamorous list I would tape to the sprint board. Not because it is complete. Because it would have changed the shape of this attack.
Share pricing rules that survive a rented tick: 1. Never mint or burn from raw slot0 alone. 2. Require TWAP or a second feed for valuation. 3. Cap the allowed spot-TWAP deviation. 4. Enforce slippage on every sensitive path. 5. Rate-limit repeated deposit-withdraw loops. 6. Fuzz with flash-loan sized swaps in CI. 7. Pause paths if tick jumps exceed a bound.
Notice what is not on the list. “Hope the pool is too deep.” Hope is not a control. Depth changes. Incentives change. Copycat vaults appear with thinner books and the same Solidity comments.
Also notice the loop control. Researchers said the attacker came back at the inflated values more than once. A vault that allows rapid recycle against a stale or manipulated mark is volunteering for extra damage. One bad price is a cut. A loop is a bleed.
How This Fits The Broader DeFi Risk Picture
Every cycle we pretend the industry graduated. Then a spot read shows up in a valuation function and we all act surprised. Oracle risk never left. It just changed costumes. Sometimes the costume is an off-chain signer. Sometimes it is a thin stable pool. Sometimes it is slot0 on a V3 pair that a vault treats like a court ruling.
Risk management in this corner of crypto is not only about token beta. It is about whether your claim on a vault can be repriced by someone who does not intend to keep the position. That is a different animal from “ETH went down 4%.” Price drawdowns hurt. Accounting draws can empty the cupboard while the chart looks almost fine.
I do not think every protocol needs a novel cryptoeconomic paper to survive. I do think every protocol that mints shares needs to assume a hostile block builder environment, cheap flash liquidity, and a reader who will call the most convenient function in the most convenient order. If your tests only cover happy paths, you are documenting hope again.
Reading The Loss Without Turning It Into Theater
There is a temptation to dress these posts in panic. Resist it. Panic helps nobody count. The facts are tight. A flash loan supplied temporary size. Uniswap V3 spot moved. Hypervisor share math followed the moved spot. Repeated deposit and withdraw extracted about 10.71 ETH. Missing TWAP, missing oracle checks, missing slippage protection. That is the skeleton.
Everything else is interpretation, and interpretation should stay honest. This was not proof that automated market makers are broken. It was proof that a wrapper around an AMM can still be naive. AMMs publish prices because traders need them. Vaults consume prices because accountants need them. Those two jobs collide when the consumer forgets the publisher can be shoved.
If you are a LP in similar wrappers, ask for the pricing function. If you are a founder, put the attack path in your public docs before someone else puts it in an alert. If you are an allocator, size positions as if mid-five-figure methods can be replayed. Because they can.
What I Would Watch Next
Copycat scans. That is the boring prediction and it is usually the right one. Once a pattern is named, other contracts with the same read pattern become a checklist. You do not need a genius for that. You need a script and patience.
I would also watch whether Float Protocol, or whoever maintains the affected vaults, changes the valuation path in public. A quiet patch is better than no patch. A public postmortem is better than a quiet patch. Users deserve to know whether the next deposit still consults a tick that can be rented.
And I would watch liquidity concentration in the referenced pool. If the book stays thin around the active range, the same shove stays cheap even after a code fix elsewhere. Code is one surface. Market structure is the other. Attacks like this sit on both.
A Plain Closing Thought
DeFi keeps selling composability as a feature. It is a feature. It is also a permissionless staging area. Anyone can borrow a set, rearrange the furniture, ask your vault to appraise the room, and put the furniture back before the credits roll. If your appraisal uses the last glance at the room, you will pay for the performance.
Float Protocol paid about $28,000 for that performance. The audience was a single transaction. The lesson travels farther than the loss. Price is not a feeling and it is not a screenshot of slot0. Price, for a share-issuing vault, has to be something an attacker cannot afford to own for the length of a block. Until that bar is the default, these alerts will keep arriving with different names and the same bones.
So ask the ugly question the next time a vault looks tidy on a dashboard. What happens if someone rents the tick? If the answer is “we would notice later,” you already noticed too late. Later is how 10.71 ETH leaves. Later is how a small hole teaches a large class of contracts the same expensive sentence: spot is a rumor until time, bounds, and second sources make it a number you can live with.
