Kolan protocol's Uniswap V4 hook exploited via flash loan and price manipulation for $3.0K loss due to missing slippage guards in buyback logic.
Security & Exploits ·
A Uniswap V4 hook operated by Kolan protocol was exploited on October 15, resulting in approximately $3.0K in losses. The KolanHook contract, which manages ETH and token reserves for expired "window" positions, lacked slippage protection in its buyback logic, allowing an attacker to manipulate prices and drain reserves.
The exploit operated in stages: an attacker borrowed 6.7 WETH via flash loan from Balancer, then purchased KLN tokens to artificially inflate the pool price. By calling the permissionless accept() function twice to close windows, the attacker forced the hook to execute buyback swaps at the manipulated price without price-limit safeguards (sqrtPriceLimit set to only MIN_SQRT_PRICE+1). The hook expended approximately 2.31 ETH (~$5.4K) buying and burning tokens at inflated rates. The attacker then sold pre-accumulated KLN into the ETH-enriched pool, repaid the flash loan, and retained approximately 1.28 ETH (~$3.0K) as profit.
The vulnerability stems from a logic error in the buyback mechanism that failed to implement adequate slippage guards, leaving the contract exposed to price-oracle manipulation. The victim contract remains on-chain with reduced reserves, though it remains unclear whether Kolan has issued a remediation or security update.