UnifiProtocol exploit analysis

Unifi Protocol's reward manager on BNB Chain was drained of 5.859 BNB on 2026-09-09 when an attacker injected a fake pool whose address was also the contract that called the manager's mintUP and claimUP (attack transaction, block 121045767). DeFiHackLabs reconstructs the fake-pool injection on a BSC fork.

The reward manager trusts a pool argument for both eligibility checks and the math in mintUP/claimUP. It never verifies that the address it receives as pool has been registered, and it trusts msg.sender to be the pool itself for the eligibility check. The attacker deployed a contract that was both the fake pool and the manager's caller, so msg.sender == pool held by construction and the eligibility check passed. The unverified reward manager contract was mined-selector; DeFiHackLabs reconstructed the interface from the attack trace (mintUP / claimUP selectors confirmed). The UPRedeemer at 0x1b8c6808b48C7A9b6997b6dAEF6401307B2B419A is verified and exposes a public redeem(uint256) path the attacker uses to realise value.

DeFiHackLabs records the loss as ~5.859 BNB and notes that the contract remains unpaused with ~9.17 BNB still in the treasury, meaning the bug is re-exploitable.

The fix is two-fold: require pool to match a registry entry the manager controls, and require msg.sender to match the pool the manager reads rather than trusting caller-supplied context.