Team Finance Hack

Reported loss $15.8M
Ethereum
V2-to-V3 migration input validation failure

What happened

On 27 October 2022, an attacker exploited Team Finance's Uniswap V2-to-V3 liquidity-lock migration route on Ethereum. The migration feature was intended to move a locker’s own V2 position into V3 without releasing it, but it did not bind the supplied migration inputs to the stored lock. After first creating locks for arbitrary tokens, the attacker migrated legitimate locked liquidity from CAW, FEG, TSUKA, and KNDX pools into attacker-controlled V3 positions.

Contemporary estimates differ between roughly $14.5 million and $15.8 million; the figure shown here is the approximate $15.8 million gross loss.

Technical root cause

The V2-to-V3 migration path accepted caller-supplied pair and token-amount values without verifying that they matched the stored lockedERC20 record. That allowed an arbitrary lock to authorize migration of unrelated custody assets and attacker-controlled V3 setup inputs.

How it happened

  1. The attacker first created and locked bogus token data, satisfying a migration-path condition without owning the valuable positions later targeted.
  2. In the main transaction, the attacker called the Pool migrate() route with pair and amount inputs that were inconsistent with the stored lock.
  3. The migrator burned real Uniswap V2 LP tokens held by the vault, then used attacker-controlled V3 setup parameters.
  4. By skewing the resulting V3 position, the migration refund path returned a disproportionate residual to the attacker’s contract.
  5. The same pattern was used against multiple locked pools.
  6. The issue was a custody and input-binding failure in the migration flow, not a flash-loan, oracle, or reentrancy exploit.

Protocol details

Classification Protocol Logic / Other / Input Validation
Protocol Type Token Locker
Implementation language Solidity
Protocol links Website @teamfinance_
Attacker Address 0x161cebB807Ac181d5303A4cCec2FC580CC5899Fd
Exploit Transaction 0xb2e3ea72d353da43a2…b2601277ce

Security review history

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes