Sharwa.finance's MarginTrading contract exploited for $32.8k via unsafe Hegic NFT collateral pricing on low-liquidity Uniswap V3 spot without TWAP or oracle fallback.
Security & Exploits ·
Sharwa.finance's MarginTrading contract was exploited for approximately $32,850 on May 1, 2026, via a vulnerability in how the protocol priced Hegic option NFT collateral. [The vulnerability lay in the contract's reliance on Uniswap V3's spot Quoter to determine collateral value, querying a low-liquidity USDC.e/USDC pool without any time-weighted average price (TWAP) mechanism or fallback to a traditional oracle such as Chainlink.
The attacker executed the exploit by initiating a safeTransferFrom call on a Hegic option NFT, which triggered the onERC721Received callback within their own contract. This callback hijacking allowed the attacker to drain approximately 33,000 USDC from the MarginTrading contract before the transaction completed. [The attacker's address is documented on Arbiscan.
The incident underscores a broader class of oracle manipulation risks in DeFi protocols that price illiquid collateral without adequate price feeds. It remains unclear whether additional safeguards have since been deployed or whether similar vulnerabilities persist in other contracts relying on spot pricing for non-fungible assets.