UNCX Network's VestingManager exploited for ~$89K via share-accounting manipulation across five token pools.
Security & Exploits ·
UNCX Network's VestingManager contract was exploited for approximately $89,000 across five token pools on Ethereum. The attack targeted the vesting mechanism by manipulating share accounting—the method the contract uses to track and distribute tokens to users holding portions of shared deposit pools. By flash-borrowing tokens and creating instantly vested tranches, the attacker was able to artificially inflate their share of the total vesting pool and withdraw funds belonging to other users.
The vulnerability operates in how the release function calculates payouts: it distributes tokens proportional to an attacker's releasable shares relative to the total shares and the entire contract balance, rather than isolating each user's individual deposit. The attacker combined vesting creation, top-ups, cancellations, and withdrawals to maximize this share fraction across five separate pools—EDGEN, ZC, LO0P, PEPECOIN, and PAAL—draining tokens from the shared balance into a single attacker address.
The core architectural flaw remained unpatched during the attack window, allowing the share-accounting logic to be exploited repeatedly. It is not yet clear whether UNCX has deployed fixes or what recovery measures may be underway for affected users.