UNCX Vesting V2 Contracts Exploited Through cancel() Share-Accounting Bug
UNCX’s Vesting V2 contracts were exploited through a share-accounting flaw in the VestingManager contract’s cancel() logic, according to a security incident record from SlowMist’s hacked-events database and technical analysis shared by security researchers. The exploit centered on how released and canceled vesting shares were tracked, allowing an attacker to distort the pool’s withdrawal calculations.
ExVul’s analysis said the attacker used a sequence involving createVesting, topUpVesting, cancel and release on self-owned positions to inflate the amount of releasable shares. That accounting mismatch reportedly let the attacker drain roughly $87,700 across several Ethereum-based tokens, including EDGEN, ZC, PEPECOIN, LO0P and PAAL.
How the accounting bug was described
According to the technical breakdown, the issue arose because release() reduced the global share balance while leaving released shares recorded in the position’s own accounting data. When the position was later canceled, the contract allegedly subtracted those shares again, which could leave the global pool mispriced relative to individual vesting records.
That mismatch was described as the mechanism that let the attacker withdraw tokens tied to other vesting positions. The exploit was framed as a bookkeeping failure inside the vesting contract rather than a compromise of private keys or user wallets.
Secondary coverage indicated that the incident affected more than one token, but the Ethereum losses and token list were the clearest details available in the technical write-up. The broader scope of the incident beyond the Ethereum positions was not fully established in the material reviewed.
UNCX’s vesting system is designed to lock token distributions and release them over time, so a flaw in share accounting can affect how much value individual positions can withdraw. In this case, the reported attack path relied on contract logic, not on external access to user funds.
