# UNCX Vesting Bug Led to $1.49 Million Gross Drain Estimate By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/33803 Published: 2026-10-17T06:49:02.000Z Updated: 2026-10-17T06:49:02.000Z Section: Technology > A stale share count in Vesting V2 enabled oversized claims, affecting 10 tokens across Ethereum, BNB Chain, Robinhood Chain and Base. UNCX’s Vesting V2 bug let positions claim more of shared token pools than their recorded stakes justified, bringing the estimated gross amount drained to $1.49 million across four chains by Oct. 15. The first successful Ethereum drain occurred Wednesday, Oct. 14, at 11:49:59 a.m. ET (15:49:59 UTC). By 2:19 a.m. ET (06:19 UTC) Thursday, Oct. 15, the estimate included 11 drain transactions across Ethereum, BNB Chain, Robinhood Chain and Base. Rounded amounts were $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. The cross-chain figure followed the [initial Ethereum pool drain of about $86,000 in one transaction](). The incident affected 10 tokens. UNCX’s liquidity-locking contracts and legacy vesting contracts were outside the affected scope. Vesting schedules release project tokens over time, while UNCX’s shared pools support several schedules against one token balance. A position’s shares determine its claim on that pool. When release() paid vested tokens, the system lowered the pool’s overall share count but kept the released shares in the position’s record. If the position was later canceled, cancel() could subtract those shares from the pool count again. That second deduction reduced the share count attached to tokens still held in the pool. A position that remained active could then claim an outsized portion of the balance, including tokens backing unrelated schedules. The attack sequence involved multiple lock positions, a large unlock, transfers into the pool and position top-ups before cancellation and withdrawal. Copycat wallets and maximal extractable value (MEV) bots joined later. “Ultimately, the smart contract failed to make sure that no functions could break the invariant around the shares’ global counter,” said Gonçalo Magalhães, Immunefi’s head of security. The IMO project announced Friday, Oct. 16, that a white-hat had returned its affected funds and trading had resumed on the project’s Base pool. The update gave no revised total across the four chains; $1.49 million remains a gross drain estimate, not a net-loss calculation after recovery. ## Links in this article - [initial Ethereum pool drain of about $86,000 in one transaction](https://www.tokenpost.com/news/technology/31955)