Float Protocol Suffers $28K Loss Following Uniswap V3 Price Manipulation

SlowMist attributed the loss to the contracts’ reliance on slot0 data without time-weighted average price (TWAP) or oracle validation, as well as missing slippage protection. The incident is a useful reminder that a vault’s advertised capital efficiency is only as durable as the pricing reference and execution controls behind its share calculations.

The pricing boundary that failed

The attack began with large swaps in the underlying Uniswap V3 liquidity pool. Those trades temporarily distorted slot0, the pool data that contains the current price and tick information. The affected Hypervisor contracts then used the altered data to calculate liquidity-provider share values.

SlowMist said the manipulation changed the values returned by currentTick and getTotalAmounts. That created an opening for the attacker to repeatedly deposit into and withdraw from the contracts while their shares were being calculated against inflated values. The sequence did not require a long-term change to the pool: the flash loan supplied temporary capital for the large swaps.

A flash loan is borrowed without upfront collateral, provided the loan and its fees are repaid within the same blockchain transaction. If repayment does not occur, the transaction reverts. The same temporary liquidity that supports arbitrage, collateral swaps and liquidations can therefore become an attack tool when another contract trusts a manipulable price source.

The reported weakness was not simply the presence of a volatile market. It was the lack of a boundary between an instant pool state and a more durable reference point. SlowMist identified the missing TWAP or oracle checks, together with absent slippage protection, as the relevant design gaps. The security firm also identified two vulnerable contracts and the underlying liquidity pool involved in the incident.

The practical A-versus-B trade-off

For a yield strategy, there is a meaningful difference between using a live spot price and validating a price before capital is accepted. In the first scenario, a vault may appear highly capital-efficient in normal conditions because it reacts directly to the current pool state. The trade-off is that a large swap can alter the apparent value of a deposit before the transaction settles.

In the second scenario, a contract checks a time-weighted reference or another oracle and applies slippage limits. That adds a layer of protection against an isolated, distorted quote, although it does not remove every execution or smart-contract risk. The relevant question is not whether a protocol uses Uniswap V3, but how it handles the moment when the pool’s current price differs sharply from the reference used to mint or redeem shares.

That distinction matters for a sustainable baseline. A yield figure can look attractive while the pricing mechanism is quietly dependent on conditions that an ordinary user cannot easily monitor. The more important review is whether the contract can preserve sensible share values when liquidity moves suddenly, even if the final loss shown in an alert is modest.

What readers should verify

Anyone assessing Float Protocol or a similar Hypervisor-style vault should begin with the pricing path rather than the headline APY. Check whether deposits, withdrawals and share pricing rely directly on the current pool spot price. Then look for evidence of TWAP or oracle validation on the critical functions, plus slippage protection that limits how far execution can move from the quoted terms.

It is also reasonable to ask how the system behaves when a large swap changes the pool state. Can the share calculation remain stable? Are deposits and withdrawals exposed to the same manipulated input? Are there documented safeguards for unusual liquidity conditions? These questions are more useful than treating the reported $28,000 loss as either insignificant or, by itself, proof of a protocol-wide failure.

The Crypto Times reported that Float Protocol had not published an official statement about the exploit at the time of publication, after attempting to contact the project for comment. Until there is clearer information on remediation or any user impact, claims about recovery, broader exposure or the present status of the contracts should remain unconfirmed. The durable lesson is straightforward: preserve capital by checking the price boundary before evaluating the yield.