Float Protocol Hypervisor — Uniswap V3 spot-priced deposit/withdraw sandwich

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-08-FloatProtocol_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/FloatProtocol_exp.sol.

Vulnerability classes: vuln/defi/sandwich-attack · vuln/oracle/spot-price · vuln/oracle/missing-circuit-breaker

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/FloatProtocol_exp.sol.

Key info#

TL;DR#

Float's Hypervisor (Gamma/Visor concentrated-liquidity vault) prices LP shares off getTotalAmounts(), which values the Uni V3 position at the pool's instantaneous slot0 — no TWAP, no deviation guard on the permissionless deposit/withdraw path (whitelist disabled). Two hypervisors share one pool, so one tick move prices both.

Inside a Morpho 1,000 WETH flash + a V2 flash-swap of 120,000 token0:

1. V3 dump 114,000 token0 → WETH (skew slot0 down).
2. Deposit (2000 / 200) into Hypervisor A and (4000 / 400) into B via DepositProxy; immediately withdraw those shares (mint at the skewed price).
3. V3 buy token0 with 250 WETH (skew back up).
4. Single-sided token0 deposits (395,035 and 394,911) into A and B, then withdraw — redeeming a WETH-richer mix than deposited.
5. Repay the V2 flash-swap, dump leftover token0, settle surplus token0 into ~8.26 WETH via a second V2 swap, repay Morpho, unwrap to ETH.

Net 10.7066 ETH to the attacker EOA.

Background#

Gamma/Visor Hypervisors wrap a Uni V3 position. Users deposit(amount0, amount1, to) through a UniProxy; shares are sized from getTotalAmounts(). withdraw(shares, to, from) burns shares for a proportional slice of the vault's real token0/token1.

token0 = 0xb050…7cb9 (Float pair token, 18 dp), token1 = WETH. Both hypervisors and both DepositProxies are source-verified; deposit(uint256,uint256,address) and withdraw(uint256,address,address) are the real 3-arg signatures.

This is the same class as Arrakis G-UNI (spot-priced mint/burn) on a different wrapper.

The vulnerable code#

Verified Hypervisor getTotalAmounts() (conceptual; Gamma public source):

function getTotalAmounts() public view returns (uint256 total0, uint256 total1) {
    // reads pool.positions + pool.slot0() / currentTick
    // converts in-range liquidity at the INSTANTANEOUS sqrt price
    // plus idle balances sitting on the hypervisor
}

deposit mints shares = f(amount0, amount1, getTotalAmounts(), totalSupply) with no TWAP. withdraw pays shares/totalSupply of the actual token balances (and burned V3 liquidity), not of the tick that was used at mint.

Move the tick between those two public calls and the share is issued against a lie.

Root cause#

Mint is spot-priced; redeem is inventory-priced. An unprivileged caller with a flash loan:

• Pushes slot0 so getTotalAmounts() over-states one side.
• Deposits at that valuation (cheap shares).
• Pushes slot0 back.
• Withdraws a mix whose WETH leg exceeds what was deposited.

Two vaults on one pool double the surface: the same two swaps reprice A and B.

Preconditions#

• Deposit whitelist disabled (it was).
• Shared Uni V3 pool thin enough that 114k token0 / 250 WETH moves the tick across a useful range.
• Flash liquidity: 1,000 WETH (Morpho) + 120,000 token0 (V2 pair).

Attack walkthrough#

Exact amounts from test/FloatProtocol_exp.sol:

attacker ETH profit: 10.706591043820923462
[PASS] testExploit()

Diagrams#

Remediation#

1. Price deposits and withdrawals off a TWAP (or a same-tx snapshot taken once).
2. Deviation / max-tick-move guard on deposit/withdraw, not only on rebalance.
3. Same-tx lock: newly minted shares cannot be withdrawn until a later block.
4. Re-enable the deposit whitelist or cap deposits vs pool depth.

How to reproduce#

_shared/run_poc.sh 2026-08-FloatProtocol_exp --mt testExploit -vvvvv

Expected: [PASS] testExploit() with attacker ETH profit: 10.706591043820923462.

Reference: https://x.com/exvulsec/status/2094361997311877399

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-08-FloatProtocol_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: FloatProtocol_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "Float Protocol Hypervisor".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.