Float Protocol has lost about $28,000, or 10.71 ETH, after an attacker used a flash loan to manipulate a Uniswap V3 spot price and exploit how its Hypervisor contracts calculated liquidity provider share values.
How the Attack Worked
SlowMist said on Aug. 31 that the attacker distorted the Uniswap V3 slot0 spot price, causing affected Hypervisor contracts to calculate incorrect LP share values. Using large swaps in the underlying V3 liquidity pool, the attacker manipulated the values returned by currentTick() and getTotalAmounts(). The attacker then repeatedly deposited and withdrew funds while the Hypervisor contracts were working with inflated share values.
Missing Price Protections
The security firm traced the exploit to functions that lacked TWAP or oracle verification and slippage protection. A TWAP uses observations collected across a period instead of relying solely on the price available at one moment. Spot prices inside liquidity pools can move when a sufficiently large trade changes the ratio between pooled assets. Without a TWAP or independent oracle, the contracts relied on a manipulable spot price.
Flash Loans Enable the Exploit
Flash loans allow assets to be borrowed without upfront collateral as long as the loan and fees are repaid within the same blockchain transaction. The mechanism lets traders access large amounts of temporary liquidity, but the same liquidity can be used to exploit vulnerable pricing or smart contract logic. Similar methods were used in the Allbridge Core exploit in July, where an attacker used a $1.12 million USDC flash loan to manipulate a stablecoin pool ratio.
Price Manipulation Remains a Top DeFi Attack Vector
The Float Protocol incident adds to a pattern of price-manipulation attacks in DeFi. In July, Ostium concluded that its $23.75 million USDC exploit originated from compromised off-chain price infrastructure rather than smart contract flaws. The Swan Treasury exploit used a PancakeSwap flash loan after a compromised signer key allowed discounted token purchases. Each case demonstrates that oracle dependencies and price feed vulnerabilities remain critical attack surfaces for lending and liquidity protocols.
