Impermax V3 Hack

On April 27–28, 2025, Impermax V3 suffered an exploit resulting in a loss of approximately $300K, with an additional $300K–$350K at risk if borrowers repay loans and unlock vulnerable liquidity.

The attacker exploited a misvaluation in how Impermax handled uncollected trading fees used as collateral. By manipulating a low-liquidity Uniswap V3 pool and inflating the uncollected fee value through multiple swaps, they were able to borrow against this artificially high collateral. They then auto-compounded the fees at an incorrect price tick, reducing real collateral value due to impermanent loss, before reverting the tick to extract value.

The attacker repeated this process to drain available liquidity and dilute lenders via the restructureBadDebt() function, securing stolen funds before legitimate users could react.