@UNCX_token hacked for ≈$87.7K.

Rickler Feed (@rickler_feed), Oct 14, 2026, 17:55 UTC

@UNCX_token hacked for ≈$87.7K. Root cause: VestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares. After release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released, so already-released shares are removed from the global total a second time. The attacker used a direct donation to magnify this stale-share debit, corrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users. Attack t…

The excerpt is quoted from a public Telegram channel, which owns its text.

Read the original post on Telegram

More posts from Rickler Feed · All channels