Security1 hOctober 16, 2026, 21:38

KolanHook Exploit: Unguarded Uniswap v4 Buyback Drained ETH

On October 15, 2026, an attacker drained about 2.31 ETH from KolanHook, a Uniswap v4 hook on Ethereum mainnet, netting roughly 1.28 ETH after repaying a flash loan. The flaw: accept(id) let anyone close an expired window and trigger a KLN buyback with no slippage protection.

DEV Community

Open source

KolanHook Exploit: Unguarded Uniswap v4 Buyback Drained ETH

About 2.31 ETH left the KolanHook contract; attacker net profit was roughly 1.28 ETH
A 6.7 WETH Balancer flash loan pumped the KLN spot price before the forced buyback
The buyback used sqrtPriceLimitX96 = MIN_SQRT_PRICE + 1, effectively no slippage limit
Kolan's contracts were tested but never audited

#Uniswap#Ethereum#KolanHook#Balancer

Uniswap V4 Vault Exploit on Polygon: One Wei of Shares Drained 14,838 DAI

Security

Hacker turns 25 cents into 46 billion fake Bitcoins to steal $770,000 from Symbiosis DeFi exchange

Security

Tag confusion in AWS Load Balancer Controller can expose databases to the internet

Security

KolanHook Exploit: Unguarded Uniswap v4 Buyback Drained ETH

Uniswap V4 Vault Exploit on Polygon: One Wei of Shares Drained 14,838 DAI

Hacker turns 25 cents into 46 billion fake Bitcoins to steal $770,000 from Symbiosis DeFi exchange

Tag confusion in AWS Load Balancer Controller can expose databases to the internet

Balancer shuts down: BAL holders vote Sep 25 to claim $9M treasury or forfeit