FloatProtocol exploit analysis

Float Protocol's Hypervisor vaults on Ethereum price LP shares off getTotalAmounts(), which values the vault's V3 position at the underlying pool's instantaneous slot0 spot price. There was no TWAP, no deviation guard, and no slippage check on the permissionless deposit() / withdraw() path. An unprivileged actor could push the tick with a large V3 swap on the underlying pool, deposit into the hypervisor while the valuation was skewed, move the tick back, and withdraw a richer token mix than it put in.

The attacker (EOA 0xAEA29218262dc6b0904Ca077f6527C49dfd426D9, via callback contract 0xb46655eb5b77de277063a75586d1883e951b6c54) ran the exploit in a single transaction on block 25874402 of Ethereum (0x3d7549db65344da2a41067e17791b17fac16ec6b8e5132e82e243f6541de5cff), flash-loaning 1,000 WETH from Morpho Blue as working capital. The two hypervisor vaults share the same underlying V3 pool; both are worked with the same tick moves.

Inside the Morpho onMorphoFlashLoan callback, the attacker UniV2 flash-swapped 120,000 of the Float pair token from the token0/WETH pair as additional working capital, then inside that callback dumped 114,000 token0 into the V3 pool to push slot0 down. With the spot price skewed, the attacker deposited (2,000 token0 / 200 WETH) into Hypervisor A via the DepositProxy and immediately withdrew its shares, then (4,000 / 400) into Hypervisor B and withdrew those shares, minting at the skewed price. The attacker then bought token0 with 250 WETH to push the tick back, single-sided deposited the 395,035 / 394,911 token0 balances that resulted into the same vaults, redeeming a WETH-richer mix than deposited, repaid the 120,000-token0 flash-swap plus its 0.3 percent fee, and dumped the leftover token0 back to WETH with a final V3 swap. The surplus token0 was settled into ~8.26 WETH through a second flash-swap, Morpho was repaid, and the net ~10.7066 WETH was unwrapped to ETH and sent to the attacker EOA.

The two Hypervisor vaults and the DepositProxy (Gamma UniProxy) are source-verified, so deposit(uint256,uint256,address) and withdraw(uint256,address,address) are the real 3-argument signatures observed in the trace. The vulnerable pricing math runs inside Float's own on-chain Hypervisor / Uniswap contracts on the fork.

The fix is to value the position off a TWAP, a deviation guard, or an external reference price, rather than slot0 alone. Even a one-block TWAP over the prior few blocks would prevent the flash-loan-funded push-and-restore from setting the price the same block the attacker then read.