UNCX Network’s shared vesting contract was exploited on Oct. 14 in an attack that security researchers said turned a small residual position into roughly $86,000 in withdrawals. The incident did not rely on stolen private keys, but on a flaw in the contract’s internal accounting that let one position draw from assets tied to other users.

Blockaid said about $3.25 million was still sitting in the affected Ethereum contract when it identified the exploit as ongoing. UNCX, formerly known as Unicrypt, later said the breach affected 10 tokens across Ethereum, Base, BNB Chain and Robinhood Chain.

How the attack worked

Blockaid described a sequence in which the attacker created vesting positions in the shared pool, released a large one, donated tokens into the contract, and then canceled a topped-up vesting position. That process allegedly left behind a tiny vest that could withdraw tokens belonging to other users.

Exvul traced the issue to UNCX’s VestingManager contract and its treatment of released and canceled token shares. According to the researchers, the contract’s release() function reduced the global totalTokenShares value without removing the released shares from the position’s depositedShares record. When that position was later canceled, the contract deducted shares using the original recorded deposit, effectively applying the reduction twice. A direct token donation further skewed the accounting.

The outcome was a mismatch between the contract ledger and the assets it held. Researchers said that discrepancy made a nearly empty vesting position behave as if it carried a much larger claim on the shared token pool.

Why the design amplified the risk

UNCX provides tools for projects to lock liquidity and distribute tokens under predetermined schedules. In a shared vesting pool, multiple projects use the same smart-contract infrastructure, with the contract keeping separate records for each position.

That setup can reduce costs and simplify management, but it also concentrates accounting risk. If the shared bookkeeping breaks, positions tied to unrelated projects can be exposed at the same time because their balances depend on the same contract logic.

Tokens affected and UNCX response

Early reports said the theft involved five tokens: EDGEN, ZC, PEPECOIN, LO0P and PAAL. UNCX later updated the scope, saying the exploit affected 10 tokens in total across four blockchains.

UNCX said it blocked new vesting positions from entering the affected contract while reviewing transactions and assessing losses. The company initially set flat fees of 100 ETH, or equivalent, across vesting contracts, then said it raised flat fees above 1,000 ETH per lock, increased token fees to 5%, and closed methods that could bypass those charges.

The company also said its liquidity lockers and legacy vesting contracts were not affected by this incident.

Investigation and next steps

UNCX said no stolen funds had been returned, either by the original attacker or by copycats. It is working with law enforcement and SEAL 911 while contacting affected projects and preparing a fuller incident report with financial findings and a proposed recovery plan.

For now, the final loss figure remains uncertain even as the known amount tied to the exploit is about $86,000. The next confirmed step is UNCX’s promised comprehensive report, which is expected to outline the damage in more detail and describe how the platform plans to address recovery for impacted projects.

Source: news.bitcoin.com