$BNB Vesting V2 Vulnerability Leads to $1.49 Million Loss - A Lesson on "Invariants" in Smart Contracts
Yet another hack this time, a logic error within a contract’s accounting mechanism.
A vulnerability in UNCX’s Vesting V2 exposed a flaw in how shares were accounted for, allowing an attacker to inflate the number of tokens they could claim from a shared pool. Approximately $1.49 million was drained across the Ethereum, BNB Chain, Base, and Robinhood chains.
According to details provided by Gonçalo Magalhães (Immunefi):
The release function failed to deduct the shares that had already been released.
The cancel function subsequently double counted the unvested shares, artificially inflating the value of the remaining stake
The contract failed to maintain an "invariant" regarding the global share counter
This is a classic error: an invariant has been broken. The issue does not lie in a single function, but rather in the contract’s failure to ensure that the total number of shares always reflects reality. When a global counter exists, every function must respect it in this case, both release and cancel failed to do so.
Magalhães recommends a measured response: first, privately contact the affected team and major depositors; only issue a public warning to withdraw funds as a last resort. Transaction history can be used to distinguish the original exploiter from copycat attackers. This professional approach helps prevent unnecessary panic.
As for UNCX, the team has increased fees to prevent further exploitation, is coordinating with law enforcement, and intends to publish a full technical breakdown along with a remediation plan.
Smart contracts must do more than just "work" they must also safeguard their core invariants. A single missing subtraction operation can result in the loss of millions of dollars. Ultimately, a vesting contract is still a smart contract and like any other, it is susceptible to being hacked.
An accounting vulnerability seemingly minor, yet with massive consequences. What do you guys think?
Yet another hack this time, a logic error within a contract’s accounting mechanism.
A vulnerability in UNCX’s Vesting V2 exposed a flaw in how shares were accounted for, allowing an attacker to inflate the number of tokens they could claim from a shared pool. Approximately $1.49 million was drained across the Ethereum, BNB Chain, Base, and Robinhood chains.
According to details provided by Gonçalo Magalhães (Immunefi):
The release function failed to deduct the shares that had already been released.
The cancel function subsequently double counted the unvested shares, artificially inflating the value of the remaining stake
The contract failed to maintain an "invariant" regarding the global share counter
This is a classic error: an invariant has been broken. The issue does not lie in a single function, but rather in the contract’s failure to ensure that the total number of shares always reflects reality. When a global counter exists, every function must respect it in this case, both release and cancel failed to do so.
Magalhães recommends a measured response: first, privately contact the affected team and major depositors; only issue a public warning to withdraw funds as a last resort. Transaction history can be used to distinguish the original exploiter from copycat attackers. This professional approach helps prevent unnecessary panic.
As for UNCX, the team has increased fees to prevent further exploitation, is coordinating with law enforcement, and intends to publish a full technical breakdown along with a remediation plan.
Smart contracts must do more than just "work" they must also safeguard their core invariants. A single missing subtraction operation can result in the loss of millions of dollars. Ultimately, a vesting contract is still a smart contract and like any other, it is susceptible to being hacked.
An accounting vulnerability seemingly minor, yet with massive consequences. What do you guys think?