Float Protocol Hack

Reported loss $28K
Ethereum
Spot Price Manipulation

What happened

On August 31, 2026, an attacker took about 10.71 ETH (roughly $28,000) from Float Protocol's Hypervisor contracts on Ethereum. The Hypervisors manage liquidity in a Uniswap V3 pool and priced their LP shares from the pool's live spot price (slot0), with no TWAP or oracle check and no slippage protection. Using flash-loaned funds, the attacker made large swaps to push the spot price, then deposited into and withdrew from the Hypervisors repeatedly while the share price was wrong. SlowMist flagged the attack; the Crypto Times reported that Float Protocol had not published a statement.

Exploit transaction: 0x3d7549db65344da2a41067e17791b17fac16ec6b8e5132e82e243f6541de5cff. Attacker: 0xaea29218262dc6b0904ca077f6527c49dfd426d9. Attack contract: 0xb46655eb5b77de277063a75586d1883e951b6c54.

How it happened

  1. The attacker's contract took a flash loan and made large swaps in the Uniswap V3 pool behind the Hypervisors, moving slot0 and the current tick.
  2. The Hypervisors read currentTick() and getTotalAmounts() from that manipulated spot state, so they valued their holdings and LP shares incorrectly.
  3. The attacker deposited and withdrew repeatedly at the distorted share price, receiving more assets than each deposit was worth.
  4. After repaying the flash loan, the attacker kept about 10.71 ETH.

Protocol details

Classification Oracle Manipulation
Protocol Type Yield
Implementation language Solidity
Protocol links @FloatProtocol

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
BNB Chain BeatXswap $78K lost Ethereum Secured Finance Lending $104K lost Ethereum Arrakis V1 $7K lost BNB Chain DLMC $223K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes