UNCX Vesting V2 Accounting Exploit

On October 14, 2026, UNCX Network, a provider of token-locking and vesting infrastructure, saw its shared Vesting V2 contracts drained of locked tokens across four blockchains for approximately $1.5 million. The loss began as an $86,000 drain on Ethereum and grew roughly 17-fold as copycat wallets and MEV bots piled into the same bug.

What happened

UNCX's Vesting V2 lets projects lock tokens in a shared VestingManager contract that releases them to beneficiaries over time. According to security firm Blockaid, which detected pre-exploit activity about an hour before the first drain, and ExVul, which dissected the first Ethereum transaction, the exploit was an accounting discrepancy in that shared contract — not a compromised private key.

The flaw was in how the manager tracked vesting shares across releases and cancellations:

1. The release() function reduced the global share total but did not remove the released shares from a position's own recorded deposit.
2. A later cancellation of that position then deducted the same shares a second time, corrupting the shared pool's bookkeeping.
3. The attacker chained these steps — creating positions, releasing a large one, donating tokens back, and cancelling a topped-up position — to leave a tiny leftover position able to withdraw tokens that other users had deposited into the shared pool.

Blockaid tallied about $1.49 million across 11 drain transactions: roughly $969,000 on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. Ten tokens on four chains were affected; UNCX said its liquidity-pool lockers and the legacy vesting contract were unaffected.

Aftermath

UNCX disclosed the incident the same day, calling it "isolated to Vesting V2 contracts," and moved to choke off further drains: it raised the flat fee on new locks to over 1,000 ETH, removed interfaces that let users bypass fees, and set token fees to the 5% contract maximum. The team said it was coordinating with law enforcement and SEAL 911, in contact with most affected projects, and would publish a full incident report and a proposed recovery plan that week. Neither the original attacker nor the copycat addresses had returned any funds, and no attacker identity was public at the time of writing.

Why it matters

The UNCX drain is a textbook shared-pool accounting bug: a single mis-tracked quantity — here, released versus deposited vesting shares — let one position withdraw assets backing everyone else's. It sits in the same family as Abracadabra's Cauldron rounding exploit, where debt-accounting that under-decremented a shared total inflated one actor's capacity at the pool's expense, and echoes the broader lesson of custody-by-contract failures like the Base wstETH vault drain: when many users' funds share one accounting structure, every arithmetic path that touches that structure is solvency-critical. The rapid pile-on by copycats and MEV bots — turning an $86,000 proof-of-concept into a seven-figure loss within hours — is now a standard feature of public-mempool exploits, and a reason disclosure and mitigation speed matter as much as the original patch.