Uniswap V4 Vault Exploit: How a Zero-Liquidity Share Accounting Bug Drained 14,838 DAI

Decentralized finance relies on the absolute precision of share accounting. When a user deposits assets into a liquidity vault, they receive shares representing their proportional claim on the underlying pool. If this math is flawed, the economic integrity of the entire protocol collapses. On October 9, 2026, a sophisticated yet conceptually simple exploit on the Polygon PoS network demonstrated exactly this. An attacker managed to drain approximately 14,838 DAI from a Uniswap V4 liquidity vault by exploiting a dangerous fallback branch in the contract's withdrawal logic. The attack did not rely on complex reentrancy vectors or obscure arithmetic overflows. Instead, it capitalized on a flawed assumption regarding idle assets when a vault's active liquidity drops to zero.

Incident Timeline and Mechanism

The exploit occurred at 02:23:42 UTC on October 9, 2026, targeting a specific Uniswap V4 vault deployed on Polygon PoS. The affected vault contract was located at 0x048E8831...e2AF2e5A0, and the malicious activity was routed through an exploit contract at 0xc2C6F4F7E1425bE1DCB996175Cf7852bF53c23E2. The entire sequence was executed in a single transaction (0x5b795dc5...e04a7ff2) originating from the attacker's externally owned account (EOA) at 0x59Ae3c8d...B64e9884B.

The mechanism followed a precise four-step sequence. First, the attacker deposited exactly 1 wei of DAI to acquire a single minimal share unit. While economically negligible, this satisfied the contract's basic withdrawal checks. Second, the adversary utilized temporary liquidity to execute a substantial swap within the Uniswap V4 pool, aggressively pushing the current trading tick completely outside the vault's predefined active range.

This price manipulation unlocked a permissionless strategy operation. Because the tick was out of range, the attacker was able to call the reposition() function. Third, the internal repositioning logic removed the old liquidity position but failed to establish a new one, resulting in a calculated newLiquidity of zero. Finally, the attacker immediately called the withdrawal function to redeem their single share. Because the vault's active liquidity was now zero, the contract triggered a vulnerable fallback branch, transferring its entire balance of idle assets directly to the attacker.

Root-Cause Technical Breakdown

The vulnerability resided entirely within the zero-liquidity branch of the internal _withdraw() function. Under normal operating conditions, the vault calculates a proportional payout. It determines the user's share of the total liquidity by dividing the requested share amount by the total shares, then multiplies that ratio by the currently deployed liquidity.

However, the developers included a fallback branch intended to handle scenarios where no liquidity was actively deployed. If the contract detected that liquidity == 0, it bypassed the proportional calculation entirely. Instead, it simply read the raw DAI and USDC balances held by the vault address and transferred those exact amounts to the recipient.

The fundamental logic error lies in conflating two entirely different conditions: a lack of active liquidity provision is not synonymous with a single user claiming total ownership of all idle funds.

The code mistakenly assumed that if no capital was currently deployed in the Uniswap V4 pool, the person redeeming shares at that exact moment was entitled to 100% of the idle tokens sitting in the vault. In reality, those idle tokens still belonged collectively to all existing shareholders. By forcing the vault into a zero-liquidity state while holding a massive idle balance, the attacker tricked the contract into handing over the entire treasury in exchange for a single share.

Why the Exploit Succeeded and Economic Impact

The attack succeeded because it chained external price manipulation with a permissionless internal state change. The vault allowed any ordinary account to trigger a reposition() if the current tick drifted out of range. This design choice meant an attacker could artificially force the vault into an unhandled accounting state without needing special permissions.

It is important to distinguish between the gross amount extracted from the protocol and the attacker's net profit. The vault disbursed exactly 14,838.466608989135865711 DAI to the exploit contract. However, after factoring in the costs associated with subsequent swaps, the repayment of temporary liquidity, and general execution overhead, the final transfer landing in the attacker's EOA amounted to approximately 14,813.548248 USDC.

From an on-chain security and investigation perspective, ChainSentinel frequently observes how these complex state-transition chains effectively bypass standard proportional safeguards. The economic impact was a direct loss of roughly 14,838 DAI for the vault's users, while the attacker netted just over 14,813 USDC, highlighting that exploit friction often absorbs a small percentage of the stolen value.

Concrete Lessons for Builders and Users

To prevent similar share-accounting disasters, developers must adopt stricter invariant checks around liquidity states. Here are the primary takeaways for protocol builders:

1. Never bypass proportional math for idle funds: If a vault holds idle assets while active liquidity is zero, withdrawal functions must still calculate the user's proportional share of those idle assets based on total shares. Never default to transferring the entire balance to a single caller.
2. Secure permissionless strategy operations: If a function like reposition() can be called by anyone and can drive a vault's liquidity to zero, the withdrawal logic must be resilient to that exact state. Externally influenced operations should never create fatal accounting edge cases.
3. Treat zero liquidity as a distinct state: Do not equate an empty active position with an empty vault. The contract must maintain accurate internal accounting of idle assets versus deployed assets, ensuring that share redemptions always reflect true underlying ownership.

Closing Takeaway

The drainage of 14,838 DAI from this Uniswap V4 vault serves as a stark reminder that DeFi security is only as strong as a protocol's weakest fallback branch. A single wei of economic cost should never be enough to unlock an entire treasury. As protocols continue to integrate complex automated market maker logic, developers must rigorously test edge cases where active liquidity drops to zero, ensuring that share accounting remains mathematically sound regardless of the vault's operational state.

Security-firm advisories and crypto media.