A double-counted share reduction let an attacker pull $86,000 from UNCX's shared vesting pool

The fault is a ledger entry updated in one place and not in another. Exvul's researchers found that the contract's release() function reduced the global _totalTokenShares figure without removing the released shares from the position's _depositedShares record ^[3]. When the position was cancelled later, the contract deducted shares using the original recorded deposit, so the same reduction was counted twice, and a direct token donation distorted the totals further ^[4]. Blockaid, the firm that raised the alarm, described the sequence on X. "The attacker created vesting positions in the shared token pool, released a large one, donated tokens in, then cancelled a topped-up vest so a tiny leftover vest could withdraw other users' locked tokens," Blockaid wrote ^[5].

The loss is small against the balance it was drawn from. Set $86,000 ^[1] against the roughly $3.25 million still in the contract when Blockaid identified the attack as ongoing ^[6] and the loss is about 2.6% ^[12]. That ratio is only as good as its inputs. The report pairs the $86,000 with the first five-token count, dates the $3.25 million to the moment of the alert, and does not say what the pool holds now or whether the loss was restated after UNCX's update.

We think the failure sits in the bookkeeping, and a shared pool is the costlier place for it. The case for a shared pool is that it is convenient, generally less expensive and easier to manage; the price is that when the shared bookkeeping goes wrong, funds belonging to unrelated projects land in the same predicament ^[11]. The counter-thesis is that this was one pair of functions in one contract with about 2.6% of the balance gone ^[12], and that a separate contract per allocation would carry code risk of its own. Both readings fit what has been published. We would drop the liability reading if the remaining balance reconciles with recorded deposits after a fix and the loss stops at the attacker's proceeds.

UNCX has restricted new vesting positions ^[9]. That is new lock business it has stopped taking in the pool, from a platform whose product is evidence that assets cannot be sold before an agreed date ^[10]. The platform, formerly known as Unicrypt, has operated since 2020 ^[10].