Smart Contract Bug attacks on Base

An accounting flaw in UNCX Network's shared Vesting V2 contracts let an attacker and copycats drain roughly $1.49 million in locked tokens across four chains.

A shared-unlock accounting flaw in GoldPesa's Uniswap v4 hook let an attacker net a phantom USDC debt against the protocol's rebalancing withdrawal and drain about $114,900 on Base.

Attackers abused a flaw in Limit Break's Payment Processor NFT contract — still holding stale approvals from Magic Eden users — to drain tokens and NFTs worth at least $2.8 million across five chains.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A confused-deputy access-control flaw in New Market Trading's third-party SquidRouterModule let an attacker drain roughly $3.8 million from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.

$54.7M drained from KyberSwap Elastic after a rounding error in concentrated-liquidity math let an attacker trick pools into recognising double the liquidity.