SlowMist: UNCX attack resulted in losses of about $86,000

PANews reported on October 15 that, according to SlowMist, UNCX (@UNCX_token) was attacked, resulting in losses of about $86,000. The root cause was that the contract function VestingManager.cancel(uint256) did not ensure that the shares reserved by the vesting plan covered the already-released shares. The attacker first transferred tokens directly to the management contract to lower the per-token share conversion rate, then topped up and canceled a plan whose original shares had been fully released, causing the global shares to be excessively reduced and allowing another plan under the attacker's control to claim excess tokens from the shared pool.