Пост
Этот пост по его id.
https://api.web3aggregator.io/api/v1/posts/15475 curl -H "Authorization: Bearer $W3A_API_KEY" 'https://api.web3aggregator.io/api/v1/posts/15475'Нужен ключ: W3A_API_KEY в окружении.
API отдаёт одно это сообщение: остальные части альбома там — отдельные посты, связанные полем album.
Документация API@UNCX_token hacked for ≈$87.7K.
Root cause:
VestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares.
After release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released,
so already-released shares are removed from the global total a second time.
The attacker used a direct donation to magnify this stale-share debit,
corrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users.
Attack tx: etherscan.io/tx/0x352065378…
@EthSecurity1
Ethereum (ETH) Blockchain ExplorerEthereum Transaction Hash (Txhash) Details | EtherscanEthereum (ETH) detailed transaction info for txhash 0x352065378. The transaction status, block confirmation, gas fee, Ether (ETH), and token transfer are shown.Root cause:
VestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares.
After release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released,
so already-released shares are removed from the global total a second time.
The attacker used a direct donation to magnify this stale-share debit,
corrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users.
Attack tx: etherscan.io/tx/0x352065378…
@EthSecurity1
