What happened
On January 13, 2025, UniLend V2 (@UniLend_Finance) on Ethereum was hacked for approximately 61 stETH (~$200K).
The attacker exploited UniLend V2’s flawed sequence in redeemUnderlying, where LP tokens were burned and collateral was transferred before the pool’s token balances were updated. By depositing a large amount of USDC, the attacker secured an artificially high “lendBalance” calculation due to outdated health factor checks and rounding issues in getShareValue. Consequently, they withdrew their deposited USDC while retaining stETH collateral, netting approximately 61 stETH (~$200K) in the process.
Protocol details
Evidence
Proof of concept
1 available- Code Unilend Logic Flaw
Sources
- report Post-Mortem slowmist.medium.com
- report Report the-blockchain.com
- analysis Website reference binance.com
- analysis Blog reference blog.solidityscan.com
- analysis Website reference crypto.news
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
