Unifund
DeFiHackLabs added a replay of the Unifund attack from November 10, 2026. The replay is a test anyone can run to see how it worked. Their notes say: Lost: ~4.9941 WETH headline. This PoC reconstructs one of the five exploit txs and forks mainnet at the exploit block, driving the real contracts with a fresh attacker contract and typed interface calls, no vm[.]mock, no vm[.]store and no vm[.]prank of any protocol identity: it takes a real 12 WETH flash loan from the Balancer V2 Vault (no deal() for the borrowed WETH), deploys two scratch ERC20s as the attacker's own path tokens, seeds the rigged Uniswap V2 pools, buys iFUND with 0.1 WETH to create and join a group, joins with 1 ETH, then swaps twice along the cyclic path WETH-A-B-WETH so the facet double-credits the group's WETH ledger key, and finish() plus withdraw() realize the phantom out of the core. The core held 4.994488833099649474 WETH entering the tx and this single cyclic-swap group pulls 4.628136547384151187 WETH of it out, leaving 0.366352285715498287 WETH; the measured drain is asserted. A negative control runs the identical setup with the non-cyclic path WETH-A-B and the core is not drained, isolating the cyclic path as the cause. The attacker EOA's cross-tx net over its three txs was about 4.7555 ETH; this file asserts the single tx's measured victim drain rather than the cross-tx figure.
Lost: ~4.9941 WETH headline. This PoC reconstructs one of the five exploit txs and forks mainnet at the exploit block, driving the real contracts with a fresh attacker contract and typed interface calls, no vm[.]mock, no vm[.]store and no vm[.]prank of any protocol identity: it takes a real 12 WETH flash loan from the Balancer V2 Vault (no deal() for the borrowed WETH), deploys two scratch ERC20s as the attacker's own path tokens, seeds the rigged Uniswap V2 pools, buys iFUND with 0.1 WETH to create and join a group, joins with 1 ETH, then swaps twice along the cyclic path WETH-A-B-WETH so the facet double-credits the group's WETH ledger key, and finish() plus withdraw() realize the phantom out of the core. The core held 4.994488833099649474 WETH entering the tx and this single cyclic-swap group pulls 4.628136547384151187 WETH of it out, leaving 0.366352285715498287 WETH; the measured drain is asserted. A negative control runs the identical setup with the non-cyclic path WETH-A-B and the core is not drained, isolating the cyclic path as the cause. The attacker EOA's cross-tx net over its three txs was about 4.7555 ETH; this file asserts the single tx's measured victim drain rather than the cross-tx figure