# Float Protocol: Hypervisor LP share spot-price manipulation

Float Protocol Hypervisor LP shares priced off Uniswap V3 instantaneous spot; attacker skewed tick, deposited/withdrew, netting ~10.7 ETH.

- Payout: Real-world hack
- Severity: high
- Program: FloatProtocol
- Credited: DeFiHackLabs
- Disclosed: 2026-08-31
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/FloatProtocol_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260831-floatprotocol
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Gamma/Visor-style Hypervisor vaults on Uniswap V3
**Root cause:** Hypervisor prices LP shares via getTotalAmounts() using the pool's instantaneous slot0 spot price with no TWAP or deviation guard on permissionless deposit()/withdraw().
**Steps:**
1. Flash-loan 1000 WETH from Morpho Blue.
2. Flash-swap 120,000 token0 from the token0/WETH UniV2 pair.
3. V3 swap: dump 114,000 token0 -> WETH to skew slot0 down.
4. Deposit (2000 token0/200 WETH) into Hypervisor A via DepositProxy, withdraw shares; repeat (4000/400) into B.
5. V3 swap: buy token0 with 250 WETH to skew slot0 back up.
6. Single-sided deposit ~395k token0 into A and ~394.9k into B, then withdraw shares for WETH-richer mix.
7. Repay V2 flash-swap 120,361 token0, dump leftover token0 to WETH.
8. Settle surplus token0 to ~8.26 WETH via second flash-swap, repay Morpho, unwrap and send ETH to EOA.
**How found:** Reconstructed from on-chain trace: identified that Hypervisor valuation reads slot0 spot price with no TWAP, making permissionless deposit/withdraw manipulable by a large swap.
**Exploitation:** Single-tx flash-loan-funded sequence: manipulate V3 tick down, mint Hypervisor shares cheaply, restore tick, redeem at favorable valuation, repeat with single-sided deposits; net ~10.7066 ETH (~$28K) to attacker EOA.
**Escalation:** Two Hypervisors sharing one pool worked with the same tick moves to amplify extraction.
**Insight:** When a vault prices shares off a Uniswap V3 pool's slot0, check whether deposit/withdraw lack TWAP or deviation guards — a single large swap plus deposit/withdraw round-trip extracts value; also check if multiple vaults share one pool to amplify.