OMNI404 exploit analysis

OMNI404 (O404) on Ethereum lost 2.427 WETH on 2026-09-09 when an attacker exploited the token's dual-id/amount interpretation in transfer() against a Uniswap V3 exact-output swap (attack transaction, block 25951648). DeFiHackLabs reconstructs the drain against the verified O404 source and the full on-chain trace and reproduces 2.427003380901677080 WETH in the run() tx.

O404.transfer() interprets the first argument in two ways simultaneously: as an ERC-721 id it moves 1 * units (1e18) of the ERC-20 plus the NFT, while the pool's swap logic debits only amountOut WEI for the same amount. The attacker paired O404 with a Uniswap V3 exact-output swap that asked for amountOut WEI: O404.transfer() moved 1e18 of O404 ERC-20 into the pool (treating the call as a token id transfer), while the pool only charged the WEI amount, leaving the difference as arbitrage. Across the full 4-tx block the loss summed to ~3.02 ETH.

DeFiHackLabs's note resolves the conflict between the two community framings: the operative bug is the dual ID/amount interpretation, not the floor-rounding round-trip leak.

The fix is to disambiguate the transfer entrypoint when the caller is a Uniswap V3 pool: detect the amountOut path and credit only the requested WEI value rather than a fixed 1e18 unit.