What happened
On August 5, 2026, an arbitrary-calldata flaw in Unistreets’ Ethereum launchpad factory enabled the theft of liquidity from launched-token Uniswap V4 positions.
Technical root cause
The launchpad factory accepted arbitrary calldata while it held users’ Uniswap V4 LP NFTs, allowing an injected approval call to grant control over those positions.
How it happened
The factory held launched tokens’ LP NFTs. An attacker injected a setApprovalForAll call through the factory, obtained approval over those positions, and burned them to remove liquidity.
Protocol details
Classification
Access Control
Protocol Type
DeFi Protocol
Implementation language
Solidity
Evidence
- analysis SlowMist Hacked incident index hacked.slowmist.io
- analysis DeFiLlama defillama.com
- analysis ETH Bucharest incident update paragraph.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
