UNCX Hack

On October 14, 2026, UNCX Network’s Vesting V2 contracts were exploited across four distinct chains for a total of approximately $1.49 million USD due to a share-accounting logic flaw in schedule release and cancellation functions.

The vulnerability stemmed from inconsistent accounting of _totalTokenShares between the release() and cancel() functions within UNCX Vesting V2 contracts. The attacker initialized multiple vesting schedules, fully released a subset of them, and then transferred tokens directly into the vesting contract as a donation to artificially lower the shares-per-token rate without minting new shares. By subsequently topping up and canceling the released schedules, the attacker manipulated the vesting parameters such that cancel() incorrectly deducted shares that had already been removed by prior releases.

This forced an underflow or artificial reduction in the shared _totalTokenShares denominator, which massively inflated the redemption payout of the attacker's final retained schedule. The attacker repeated this loop to drain funds across multiple tokens and chains, resulting in ~$969k on BSC, ~$242k on Ethereum, ~$169k on Robinhood Chain, and ~$114k on Base.