An attacker exploited an accounting flaw in UNCX Network’s shared vesting contract to take about $86,000 in cryptocurrency, despite holding only a small leftover token position.
The breach on 14 October targeted the system’s internal bookkeeping rather than private keys or individual wallets. About $3.25m remained in the Ethereum smart contract when blockchain security firm Blockaid identified the attack as ongoing.
“ The attacker created vesting positions in the shared token pool, released a large one, donated tokens in, then cancelled a topped-up vest so a tiny leftover vest could withdraw other users’ locked tokens,” Blockaid wrote on X.
Security researchers at Exvul later published an explanation of the weakness, which involved UNCX’s VestingManager contract and how it recorded released and cancelled token shares.
UNCX, formerly known as Unicrypt, has operated since 2020. It provides cryptocurrency projects with tools to lock liquidity and distribute tokens according to pre-determined schedules, helping show that particular assets cannot be sold before an agreed date.
Vesting allows recipients to receive tokens gradually rather than all at once, sometimes following an initial waiting period. A shared vesting pool places allocations from several decentralised finance (DeFi) projects inside common smart-contract infrastructure, while maintaining separate balances and release schedules for each position.
The arrangement can be cheaper and easier to manage than deploying a separate contract for every allocation. However, an error in the shared accounting can affect assets belonging to unrelated projects.
Exvul said the attacker created vesting positions, released tokens from a large position, deposited more tokens into the pool and then cancelled a previously funded position. That sequence generated the discrepancy used in the exploit.
The contract’s `release()` function reduced the global `_totalTokenShares` figure but did not make the equivalent reduction in the position’s `_depositedShares` record. When the position was cancelled, the contract deducted shares based on the original deposit, effectively applying the reduction twice. A direct token donation further changed the calculations.
As a result, a small residual vesting position could claim tokens supporting other users’ deposits. The attacker did not need stolen private keys: the contract’s calculations made the almost-empty position appear to represent a much larger entitlement.
The initial report identified five affected cryptocurrencies: EDGEN, ZC, PEPECOIN, LO0P and PAAL. UNCX later said the exploit involved 10 tokens across four blockchains: Ethereum, Base, BNB Chain and Robinhood Chain.
UNCX stopped new vesting positions entering the affected contract while it reviewed transactions and assessed the damage. It initially introduced flat fees of 100 ETH, or the equivalent, across vesting contracts. In its latest update, issued at 7 p.m. Eastern time on Wednesday, the company said fees had risen above 1,000 ETH per lock, token fees had increased to 5%, and methods used to avoid those charges had been closed.
The platform said its liquidity lockers and legacy vesting contracts were unaffected. It is working with law enforcement and SEAL 911, contacting affected projects and advising against trading the impacted tokens in affected pools.
UNCX said neither the original attacker nor copycats had returned stolen funds. Final losses remain uncertain, while the platform prepares an incident report containing financial findings and a proposed recovery plan.
