UNCX exploit exposes share-accounting flaw behind reported $1.5M loss

UNCX’s Vesting V2 exploit has exposed a share-accounting flaw that let attackers inflate their claims on pooled tokens, Immunefi’s security chief has explained following reports of roughly $1.5 million drained across four chains. Summary Withdrawal and cancellation functions left share accounting out of balance, according to Magalhães. Reported losses reached roughly $1.5 million across four networks, with copycat wallets and bots involved. Magalhães advised private contact with affected teams before public withdrawal warnings when possible. Providers and affected projects share responsibility for working toward reimbursement, he said. Gonçalo Magalhães, head of security at Immunefi, told crypto.news that the contract failed to keep its share counters consistent when users withdrew vested tokens and canceled positions. UNCX withdrawals left a stale share count In Magalhães’s account, the weakness began with the contract’s release function, which lets a beneficiary withdraw tokens that have become available under a vesting schedule. After a withdrawal, the function failed to subtract the released shares from the position’s counter, he said. When the cancellation function subsequentl...