The Arrakis V1 / G-UNI ENS–WETH liquidity-manager vault (0x7c687f775a3b73bbab0e15832f24caab5d53bdde) was hacked for 2.94 WETH via a Uniswap…
The Arrakis V1 / G-UNI ENS–WETH liquidity-manager vault (0x7c687f775a3b73bbab0e15832f24caab5d53bdde) was hacked for 2.94 WETH via a Uniswap V3 spot-price manipulation. RootCause: the vault's mint() and burn() value its Uniswap V3 position off the instantaneous pool.slot0() spot price, with NO TWAP or deviation guard on the user deposit/withdraw path. The vault does have a TWAP check — but it only guards the manager's rebalance() swap, never mint/burn. @EthSecurity1
The excerpt is quoted from a public Telegram channel, which owns its text.