Worked example · 2026-10

UNCX Network — release() cut the pool's total shares but left the position's deposited shares, so cancelling counted the same reduction twice — UNCX VestingManager / Ethereum, Base, BNB Chain, Robinhood Chain — 2026-10-14

Loss

~$1.49M across four chains per Blockaid's 2026-10-15 update (BNB Chain ~$969K, Ethereum ~$242K, Robinhood Chain ~$169K, Base ~$114K; 11 drain transactions including copycats and MEV bots). The first attack, on Ethereum, took ~$86K; ~$3.25M was in that contract when Blockaid flagged it. UNCX said ten tokens were affected (the first five named: EDGEN, ZC, PEPECOIN, LO0P, PAAL). No funds returned at last report.

OAK Techniques observed

OAK-T9.016 (Contract Accounting / State-Invariant Flaw — primary, per ExVul. In the shared VestingManager pool, release() reduced the global _totalTokenShares without removing the released shares from the position's _depositedShares. On cancel, the contract subtracted shares based on the original deposit, so the same reduction was applied twice and the global share count fell below what other users' positions were owed. A direct token donation further skewed the ratio, and a tiny residual position could then withdraw other users' locked tokens. See techniques/T9.016-contract-accounting-state-invariant-flaw.md). No key was stolen and no permission bypassed: every call was one the attacker was entitled to make.

Attribution

pseudonymous.

Key teaching point

In a pooled vault, every exit path must retire the same shares exactly once. Shared-pool designs price every position off one global denominator; a path that decrements the denominator without decrementing the position's own record lets that position exit again later, against everyone else's tokens. A balance donated directly to the pool is a second lever on the same ratio.