Float Protocol has lost approximately ₹22.5 lakh (10.71 ETH), totaling about $28,000, after an attacker exploited vulnerabilities in the platform's Hypervisor contracts. According to blockchain security firm SlowMist, the attack centered on manipulating the Uniswap V3 spot price and exploiting how Float Protocol's contracts calculated liquidity provider share values. The security firm traced the exploit to functions that lacked TWAP or oracle verification and slippage protection. The incident highlights growing concerns about security vulnerabilities in decentralized finance protocols and the need for enhanced security measures.
The attacker used large swaps in the underlying V3 liquidity pool to manipulate the values returned by currentTick() and getTotalAmounts() functions. As reported by SlowMist, the attacker then repeatedly deposited and withdrew funds while the Hypervisor contracts were working with inflated share values. The security firm identified the attacker address as 0xaea292218262dc6b0904ca077f6527c49dfd426d9 and the attack contract as 0xb46655eb5b77de277063a75586d1883e951b6c54. The exploited contracts were listed as 0x85cbed523459b7f6f81c11e710df969703a8a70c and 0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153. This exploit occurred through flash loans, allowing the attacker to distort the price feeds used for liquidity provisioning.
According to SlowMist, the attack relied on the affected contracts obtaining pricing information from the underlying Uniswap V3 pool without proper verification mechanisms. The security firm specifically identified the absence of TWAP or oracle validation as part of the attack path. A TWAP uses observations collected across a period instead of relying solely on the price available at one moment. The attacker distorted the Uniswap V3 slot0 spot price, which contains the pool's current price and tick information, and then changed the values returned by currentTick() and getTotalAmounts() functions. Critical functions lacked necessary TWAP/oracle validation and slippage protection, making the contracts vulnerable to manipulation.
Currently, FloatProtocol's price is listed at $0, with no trading volume reported in the last 24 hours. This lack of activity reflects the potential fallout from the exploit, as investor confidence may wane in light of security concerns. The incident not only impacts FloatProtocol but also reflects broader concerns regarding DeFi platform security, as it reveals weaknesses that could be exploited by malicious actors. As exploits like these become more frequent, regulatory bodies may intensify their focus on ensuring safer practices in the crypto space. Traders should closely monitor the implications of this incident on FloatProtocol's operations and the broader DeFi ecosystem, with potential risks including a decline in user trust and increased scrutiny from regulators.
