Date: August 31, 2026
Chain: Ethereum
Loss: 10.71 ETH, about $28K
Class: LP shares priced from a Uniswap V3 spot price the caller can move
In October and November 2021, Float Protocol put its FLOAT/WETH liquidity into two Hypervisor vaults, contracts that manage a Uniswap V3 position and hand depositors shares in it. Float's X account, which describes FLOAT as a floating, low-volatility currency built by a team of anonymous researchers, stopped posting in 2022. The two vaults stayed deployed, with liquidity still inside them, for almost five years.
At 09:35:11 UTC on August 31, 2026, a single Ethereum transaction borrowed 1,000 WETH and 120,000 FLOAT, pushed the FLOAT price around inside the Uniswap V3 pool, deposited into and withdrew from both vaults four times, repaid everything, and left 10.71 ETH, about $28,000, with the attacker. It worked because each vault priced new shares with the pool's current spot price, a number anyone with enough borrowed capital can move for the length of one transaction.
A Hypervisor holds two Uniswap V3 positions in the FLOAT/WETH pool, a wide base position and a narrower limit position, plus whatever FLOAT and WETH sit idle in the contract. Depositors add FLOAT, WETH or both and receive vault shares, and when they withdraw, the vault burns their slice of each position and pays them their proportional cut of every token it holds. Float's vaults at 0x85CB...A70C and 0xc86B...1153 both sat on the same pool, and each had a DepositProxy in front of it that checked whether a deposit's mix of FLOAT and WETH looked close to the vault's own mix.
Float had met this pool's weakness before. In January 2022, the team posted a thread explaining that its pool on Rari Capital had suffered from a lack of liquidity in a Uniswap V3 FLOAT/USDC oracle, which led to severe price manipulation. That incident involved a different contract, but the ingredient was the same one that mattered in 2026: a thin FLOAT market whose price a well-funded trader can shift.
The vault's deposit() function decides how many shares to mint in three moves, all visible in the verified Hypervisor source on Etherscan. It reads the pool's current tick through currentTick(), which returns the tick straight out of the pool's slot0, the field that holds the live spot price. It turns that tick into a FLOAT-to-WETH price and values the incoming FLOAT at it. Then it values everything the vault already holds at the same price, using getTotalAmounts(), which converts the vault's liquidity into token amounts with the same slot0 reading, and mints shares in proportion.
Withdrawals don't use a price at all. withdraw() simply burns the caller's fraction of each position and sends out that fraction of the real tokens. The two sides of the vault are measured in different ways: shares come in at whatever the spot price says at that moment, and tokens go out at their actual quantities.
If the price used to value a deposit can be set by the depositor in the same transaction, the share count stops measuring what the depositor contributed and starts measuring how far they moved the market. A coat check that hands out tickets based on the weather outside, rather than on the coat you hand over, is easy to game on a stormy day. SlowMist's alert put the same point in technical terms: the critical functions lacked TWAP or oracle validation and slippage protection. The DepositProxy's ratio check didn't close the gap either, because it compares the deposit against vault totals that come from getTotalAmounts(), the same spot-priced figure.
The attacker's wallet, 0xaea2...26D9, sent a contract-creation transaction that deployed a helper and, through it, the attack contract at 0xb466...6C54, then ran the whole attack inside that one transaction. The token transfers on Etherscan show the order.
The attack contract borrowed 1,000 WETH from Morpho and took 120,000 FLOAT out of the FLOAT/WETH Uniswap V2 pair as a flash swap. It sold 114,000 FLOAT into the Uniswap V3 pool for 12.05 WETH, which dragged the FLOAT price down. With FLOAT cheap on the pool's clock, it deposited 2,000 FLOAT and 200 WETH into the first vault through its DepositProxy and received 222.63 shares. It redeemed them immediately and got back 7,114.08 FLOAT and 199.78 WETH from the vault's balance, plus smaller amounts collected from the vault's Uniswap positions. It repeated the move on the second vault, depositing 4,000 FLOAT and 400 WETH, receiving 3,703.21 shares, and withdrawing 36,027.82 FLOAT and 397.23 WETH from the vault's balance, again plus smaller amounts from its positions.
Then it flipped the price the other way. It bought 337,465.09 FLOAT from the V3 pool with 250 WETH, which pushed FLOAT up, and deposited 395,035.56 FLOAT and no WETH into the first vault. Now FLOAT was expensive in the vault's eyes, so that one-sided deposit bought a large share of the vault, and redeeming it returned 394,911.86 FLOAT and 1.85 WETH. It ran the same one-sided deposit through the second vault and came out with 394,291.91 FLOAT and 2.76 WETH.
To close, it returned 120,361.08 FLOAT to the V2 pair, sold 233,291.42 FLOAT into the V3 pool for 238.07 WETH and 40,644.52 FLOAT into the V2 pair for 8.26 WETH, and repaid Morpho's 1,000 WETH. The 10.7066 WETH left over was unwrapped to ETH, which is the 10.71 ETH SlowMist reported.
SlowMist flagged the attack on X on August 31 and named both Hypervisor contracts as vulnerable. In replies, the security researcher Sprunky described the vaults as legacy Visor/Gamma FLOAT-ETH Hypervisors and tied them to the January 2024 exploit of Gamma's Hypervisor vaults, which turned on the same spot-price weakness. The Crypto Times reported that it contacted Float Protocol for comment and got no reply by publication, and as of October 20, 2026, Float Protocol's X account hadn't posted about the incident.
The size of the loss reflects how little was left in the vaults, not how hard they were to break. With flash loans, the attacker needed no capital up front, so the only limit on the take was what the vaults held and what the pool's price impact allowed. A DeFiHackLabs contributor has since published a proof of concept that reproduces the 10.7066 ETH profit.
Olympix reads a vault the way an attacker does, as a set of states, transitions and entry points, and it takes in the context around the code, including where each price comes from and how deep that market is, to infer the invariants the system depends on. In a Hypervisor, the state that matters is the relationship between total shares and the real tokens behind them, and the entry points that change it are deposit() and withdraw().
The signal on this path is specific: a share-minting calculation that reads a price from a pool's slot0 in the same call that mints, with no time-weighted check, no deviation bound and no minimum-shares guard from the caller. Olympix has flagged this class before in other codebases. From that signal, the engine narrows from every path through the vault, to the feasible ones that end in a mint, to the ones where the mint's price input is something a caller can change earlier in the same transaction. That's where the invariant lives: a deposit followed immediately by a withdrawal should never return more value than went in.
The engine attacks that rule from two directions. BugPoCer works outward from the system, inferring the invariant and executing paths until one breaks it, while BugScout works inward from the signal with known strategies such as spot-price manipulation around a mint. Symbolic execution supports both by solving for the swap sizes that push the price far enough.
For this vault, the counterexample is the August 31 transaction in miniature: a swap into the FLOAT/WETH pool that moves slot0, a deposit priced at the moved tick, an immediate withdrawal that pays out actual tokens, and the resulting surplus. It comes with the minimal conditions, a pool thin enough to move and a deposit priced at spot, and a generated Forge test that replays the sequence and asserts the round trip ended with more value than it started with. Because the engine runs in development, at every merge and before release, that test would have existed in 2021, when these vaults were deployed, rather than appearing as an alert in 2026.
Float's Hypervisors ran the same code from 2021 to 2026, and the code assumed nobody could move the pool's price and deposit in the same breath. Any contract that turns a market price into a share count should price with a value no single transaction can set, and test that rule against an attacker who controls the swap that comes first. To see how Olympix finds the paths in your vaults where a deposit and a withdrawal can be made to disagree, book a technical walkthrough.
Protocol: Float Protocol FLOAT/WETH Hypervisor vaults
Chain: Ethereum
Date: August 31, 2026, 09:35:11 UTC
Loss: 10.71 ETH (about $28,000 per SlowMist)
Attacker EOA: 0xAEA2...26D9
Attack contract: 0xb466...6C54
Hypervisor vault 1: 0x85CB...A70C
Hypervisor vault 2: 0xc86B...1153
DepositProxy (vault 1): 0x3803...8a28
DepositProxy (vault 2): 0x7CF8...D75f
Uniswap V3 FLOAT/WETH pool: 0xE8c2...c0Ac
Uniswap V2 FLOAT/WETH pair: 0x481D...A5A9
Exploit tx: 0x3d75...5cff
Block: 25874402
SlowMist: TI Alert on Float Protocol
DeFiHackLabs PR #1225: FloatProtocol Uniswap V3 spot-price manipulation of Hypervisor LP shares
The Crypto Times: Float Protocol Losses 10.71 ETH After Uniswap V3 Spot Price Manipulation
Float Protocol: Post-mortem thread on the Rari Capital Pool 90 incident (January 2022)