Unistreet launchpad exploited via arbitrary call injection in PositionManager, draining ~$17.75K and 9 launch LP positions through unvalidated initCalldata/modifyCalldata forwarding.
Security & Exploits ·
A vulnerability in Unistreet's LaunchpadFactoryAuto contract allowed an attacker to drain approximately $17.75K in assets and nine liquidity provider positions from the launchpad protocol on Ethereum. The exploit leveraged arbitrary call injection in the launch() function, which forwarded attacker-controlled initCalldata and modifyCalldata parameters directly into PositionManager.multicall() without validation, executing them with the factory's privileges as msg.sender.
Since LaunchpadFactoryAuto custodies all launch Uniswap V4 LP position NFTs, the attacker crafted modifyCalldata to call setApprovalForAll, granting the exploit contract approval over every position held by the factory. The attacker then invoked modifyLiquidities with TAKE_PAIR to burn nine launch positions, including token ID 360162 labeled "UNISTREET," and extracted the underlying liquidity to an attacker-controlled address.
The drained assets totaled approximately $17.74K in USDC and 0.0072 WETH from the Uniswap V4 PoolManager, alongside nine illiquid launch memecoins with unknown recovery prospects. The transaction was confirmed on Ethereum on August 6, 2026, though it remains unclear whether Unistreet has issued a postmortem, deployed a fix, or outlined remediation for affected launch participants.