Uniswap V4 Vault Exploit on Polygon: One Wei of Shares Drained 14,838 DAI

On October 9, 2026, an exploit on Polygon PoS drained roughly 14,838.47 DAI from a Uniswap V4 liquidity vault using a single minimal share unit (1 wei of DAI). The flaw was in the zero-liquidity branch of _withdraw(), which transfers the vault's entire balance to the caller instead of a proportional payout.

• Attacker deposited 1 wei of DAI and received 1 vault share
• Price manipulation made reposition() callable and set liquidity to zero
• Vault paid out 14,838.466608989135865711 DAI
• About 14,813.55 USDC reached the attacker's EOA