Team Finance Hack

TOTAL LOST $15.8M
High V2-to-V3 migration input validation failure ethereum

What happened

On 27 October 2022, an attacker exploited Team Finance's Uniswap V2-to-V3 liquidity-lock migration route on Ethereum. The migration feature was intended to move a locker’s own V2 position into V3 without releasing it, but it did not bind the supplied migration inputs to the stored lock. After first creating locks for arbitrary tokens, the attacker migrated legitimate locked liquidity from CAW, FEG, TSUKA, and KNDX pools into attacker-controlled V3 positions.

Contemporary estimates differ between roughly $14.5 million and $15.8 million; this record retains the approximately $15.8 million gross-loss estimate.

Technical Root Cause

The V2-to-V3 migration path accepted caller-supplied pair and token-amount values without verifying that they matched the stored lockedERC20 record. That allowed an arbitrary lock to authorize migration of unrelated custody assets and attacker-controlled V3 setup inputs.

Case & protocol details

Classification Protocol Logic / Other / Input Validation
Protocol Type Token Locker
Smart Contract Language Solidity
Official Website www.team.finance/
Protocol Twitter/X @teamfinance_
Attacker Address 0x161cebB807Ac181d5303A4cCec2FC580CC5899Fd
Exploit Transaction 0xb2e3ea72d353da43a2…b2601277ce

Attack Timeline

The attacker first created and locked bogus token data, satisfying a migration-path condition without owning the valuable positions later targeted. In the main transaction, the attacker called the Pool migrate() route with pair and amount inputs that were inconsistent with the stored lock. The migrator burned real Uniswap V2 LP tokens held by the vault, then used attacker-controlled V3 setup parameters.

By skewing the resulting V3 position, the migration refund path returned a disproportionate residual to the attacker’s contract. The same pattern was used against multiple locked pools. The issue was a custody and input-binding failure in the migration flow, not a flash-loan, oracle, or reentrancy exploit.

Security review history

Evidence & learning

Proof of concept

1 available

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes