Team Finance exploited for $14.5M during protocol migration despite contract audit By Cointelegraph

On Oct. 27, decentralized finance (DeFi) lockup protocol Team Finance said that over $14.5 million worth of tokens were exploited through the v2 to v3 migration function on its platform. As told by blockchain security firm PeckShield, the hacker transferred liquidity from Uniswap v2 assets on Team Finance to an attacker-controlled v3 pair with skewed pricing. By locking tokens to the contract, the attacker bypassed existing validation mechanisms and pocketed the huge leftovers as a refund for profit.

Uniswap v3 was designed with better efficiency for liquidity providers (LP) than v2 on its decentralized exchange. However, v2 smart contracts are still operational, and users must interact with a migration smart contract to migrate their LP assets from v2 to v3. PeckShield estimated that the initial attack vector required for this interaction cost just 1.76 Ether (ETH).