UNCX Network Reports Smart Token Vesting V2 Exploit Across Four Chains

The decentralized finance infrastructure provider UNCX Network has officially disclosed a security breach involving its Smart Token Vesting V2 protocol. The incident, which occurred on October 14, resulted in the unauthorized withdrawal of assets across multiple blockchain environments. According to the technical report, the exploit was categorized as a cross-chain attack targeting specific public vesting operations, leading to an estimated financial loss of approximately $36,609.

Technical Breakdown of the Vulnerability

The attacker identified and manipulated a set of public functions within the Smart Token Vesting V2 contract. By executing these operations, the exploiter created a discrepancy between the actual token balance held in the liquidity pool and the shares recorded within the system. This inconsistency allowed the controlled positions to withdraw a higher volume of tokens than they were entitled to. UNCX Network confirmed that the malicious calls did not require administrative privileges, indicating the vulnerability existed within the standard user-facing logic of the smart contract.

• The attack impacted four major networks: Ethereum, BNB Chain, Base, and Robinhood.
• A total of 10 different tokens were affected by the breach.
• Investigators identified 11 confirmed withdrawal transactions associated with the exploit.
• The majority of the losses were concentrated on the BNB Chain, totaling roughly $28,500.

Recovery Efforts and Current Status

Following the detection of the anomaly, UNCX Network engaged with security researchers and the community to mitigate further damage. The project reported that white hat hackers played a significant role in the recovery process, successfully returning a substantial portion of the diverted assets. The recovered funds include 82,143,476 X tokens and 23.8682 ETH.

Currently, there are no major tokens to be disposed of. The involved calls did not use administrative privileges, and the team is working to ensure the stability of the remaining vesting pools.

The protocol developers have indicated that the immediate threat has been neutralized. While the monetary value of the exploit was relatively limited compared to larger DeFi hacks, the event highlights the ongoing risks associated with automated vesting contracts and cross-chain synchronization. UNCX continues to monitor the affected pools to prevent any secondary exploits and has updated its security protocols to address the logic error discovered in the V2 contracts.