{"investigation":{"slug":"unilend-v2","entity_name":"Unilend V2","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"UniLend V2 is a permissionless DeFi lending and borrowing protocol deployed on Ethereum mainnet in February 2024, designed to support all ERC-20 tokens via isolated dual-asset pools. On January 12, 2025, the protocol suffered a smart contract exploit that drained approximately $197,000 from its stETH pool due to a logic flaw in health factor calculations during the asset redemption process. Despite having been audited by PeckShield and SlowMist prior to launch, the exploited vulnerability was not caught or fully remediated, and as of the last available reporting the attacker's 20% bounty offer had not yielded a fund recovery.","sections":[{"content":"UniLend V2 is the second major iteration of the UniLend Finance permissionless money market protocol, launched on Ethereum mainnet on February 12, 2024. It was developed by UniLend Finance, a project founded in 2020 by Chandresh Aharwar (CEO), Tarun Malik (CPO), and Suryansh Kumar. The protocol's primary differentiator is its permissionless design: any ERC-20 token pair can be used to create a lending and borrowing pool without requiring governance approval, a departure from curated lending protocols such as Aave or Compound. UniLend V2 supports more than 9,000 ERC-20 assets across isolated dual-asset pools. Liquidity positions are represented as non-fungible tokens (NFTs) rather than fungible ERC-20 receipt tokens, which the team described as 'Non-Fungible Liquidity.' The protocol's native governance token is UFT, which reached an all-time high of approximately $3.77 in March 2021 and was trading near $0.003 as of mid-2025, reflecting a roughly 99% decline from peak. The UFT token is listed on Binance, HTX Global, MEXC, Gate.io, and Uniswap, with a maximum supply capped at 100 million tokens.","heading":"Protocol Overview","sources":[{"url":"https://unilend.medium.com/unilend-v2-is-now-live-5b3d76831bf6","name":"unilend.medium.com","type":"other","credibility":3},{"url":"https://techbullion.com/unilend-v2-launched-on-mainnet-first-ever-permissionless-lending-borrowing-protocol-for-all-digital-assets/","name":"techbullion.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/unilend/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 12, 2025, at approximately 11:19 UTC, an attacker exploited a critical logic flaw in UniLend V2's redemption and health-factor validation mechanism, draining approximately $197,000 from the protocol's stETH lending pool. The root cause was identified as an error in the checkHealthFactorLtv0 and checkHealthFactorLtv1 functions, which relied on userBalanceOftoken0 and userBalanceOftoken1 variables that reflected stale pool balances — balances that did not account for tokens already allocated or pending transfer. This allowed the attacker to inflate the computed value of their collateral and pass health checks that should have blocked the redemption.\n\nThe attack sequence was as follows: (1) the attacker pre-positioned by depositing 200 USDC into the UnilendV2Pool contract; (2) a flash loan was taken for 60 million USDC and 5 wstETH (converted to approximately 6 stETH); (3) both the USDC and stETH were lent into the pool via the lend() function to acquire inflated lending shares; (4) the borrow() function was called to borrow 60 stETH from the pool, using the USDC deposit as alleged collateral; (5) the attacker then called redeemUnderlying(), redeeming the deposited stETH without triggering a health factor failure because the contract was using the outdated pool balance that still reflected the pre-borrow state; (6) the USDC deposit was similarly redeemed without repaying the outstanding stETH debt; (7) the flash loan was repaid, netting the attacker approximately 60 stETH in exchange for an initial outlay of 200 USDC.\n\nKey on-chain identifiers reported by SlowMist: attacker address 0x55f5f8058816d5376df310770ca3a2e294089c33; vulnerable contract 0xc86d2555f8c360d3c5e8e4364f42c1f2d169330e; primary attack transaction 0x44037ffc0993327176975e08789b71c1058318f48ddeff25890a577d6555b6ba.","heading":"January 2025 Exploit — Technical Details","sources":[{"url":"https://slowmist.medium.com/analysis-of-the-unilend-hack-90022fa35a54","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/how-a-200k-exploit-unfolded-at-unilend-04fb4918292d","name":"medium.com","type":"other","credibility":3},{"url":"https://crypto.news/defi-protocol-unilend-finance-exploited-for-197000/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.the-blockchain.com/2025/01/13/unilend-finance-losses-197-6k-to-a-redeem-process-vulnerability-exploit/","name":"the-blockchain.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the February 2024 mainnet launch, UniLend V2 smart contracts were audited by two blockchain security firms: PeckShield and SlowMist. UniLend Finance also conducted two bug bounty programs on the Immunefi platform. The PeckShield audit identified a total of 8 findings, including 1 critical severity, 3 high severity, 1 medium severity, and 3 low severity vulnerabilities. UniLend stated publicly that all identified issues were resolved prior to deployment.\n\nDespite these measures, the exploited vulnerability — specifically the stale-balance logic in the health factor calculation functions — was not caught or was not fully remediated before mainnet deployment. Security researchers who analyzed the January 2025 exploit noted that the flaw resided in how pool balance state was read at the time of health checks, a category of logic error that static analysis alone may not reliably surface. The presence of a critical-severity finding in the PeckShield audit report raises questions about whether all audit recommendations were comprehensively addressed. No post-mortem from UniLend Finance formally reconciled the audit findings against the exploit's root cause as of the latest available reporting.","heading":"Pre-Launch Security Audits and Audit Gap","sources":[{"url":"https://unilend.medium.com/a-deep-dive-into-unilend-v2s-security-c1b95d2439f5","name":"unilend.medium.com","type":"other","credibility":3},{"url":"https://www.scribd.com/document/860759163/PeckShield-Audit-UniLendV2","name":"scribd.com","type":"other","credibility":3},{"url":"https://unilend.gitbook.io/unilend-finance/audit-report","name":"unilend.gitbook.io","type":"other","credibility":3},{"url":"https://www.vibraniumaudits.com/post/unilend-finance-exploited-for-nearly-200-000","name":"vibraniumaudits.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, UniLend Finance posted an official statement on X (formerly Twitter) on January 13, 2025, confirming the security compromise. The team disclosed that the loss was approximately $200,000 — representing roughly 4% of the platform's total value locked of $4.7 million at the time of the exploit. UniLend V1 funds were confirmed to be unaffected. The team advised all users to refrain from depositing into V2 until further notice and stated it was working on a resolution for affected users.\n\nUniLend subsequently offered the attacker a 20% bounty (approximately $39,000–$40,000) for the safe return of the remaining 80% of stolen funds, a standard white-hat negotiation tactic used across DeFi. The team indicated the exploit contract was identified and that V2 deposits were paused. No public reporting confirmed the attacker accepted the bounty or returned any funds as of the latest available sources. The team also stated it had implemented a fix to the health factor calculation to ensure real-time updates of asset status during redemption.","heading":"Protocol Response and Fund Recovery Status","sources":[{"url":"https://x.com/UniLend_Finance/status/1878805205254340844","name":"x.com","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/unilend-finance-suffers-196200-loss-vulnerability-exploit/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=unilend-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.the-blockchain.com/2025/01/13/unilend-finance-losses-197-6k-to-a-redeem-process-vulnerability-exploit/","name":"the-blockchain.com","type":"other","credibility":3}],"severity":"medium"},{"content":"At the time of the January 2025 exploit, UniLend V2 reported a TVL of approximately $4.7 million, with the stolen $197,000 representing approximately 4.2% of the total locked value. While this is a relatively modest absolute figure compared to larger DeFi exploits, the incident is notable because the protocol had been live for less than twelve months and had marketed its dual-audit security posture prominently during launch. Following the exploit and the deposit pause, TVL in V2 declined significantly. DeFiLlama data reflects a sharp drop in V2 TVL following the incident. UniLend V1 continued to operate separately and retained its depositor funds. The UFT governance token, which was already trading far below its 2021 all-time high of $3.77, experienced additional selling pressure in the wake of the exploit announcement. According to CoinMarketCap, UFT was trading near $0.003 as of 2025 with a 24-hour volume under $1,000, indicating very low market liquidity for the token.","heading":"TVL Impact and Market Context","sources":[{"url":"https://defillama.com/protocol/unilend-v2","name":"defillama.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/unilend/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.gate.com/learn/articles/the-200k-dollars-uni-lend-hack-what-went-wrong-and-how-de-fi-can-do-better/5931","name":"gate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The UniLend V2 exploit illustrates a class of DeFi vulnerability — incorrect or stale state reads during health factor validation — that has appeared in multiple protocols. The permissionless design of UniLend V2, while broadening token support beyond curated protocols, also increases the attack surface: any token pair can form a pool, and edge-case interactions between pool balances and health factor logic are harder to exhaustively test. Security researchers at QuillAudits, SlowMist, and SolidityScan each published independent post-mortems confirming the root cause lay in stale balance reads, not in any exotic oracle manipulation. The flash loan vector was a delivery mechanism rather than the primary vulnerability.\n\nThe protocol's audits by PeckShield and SlowMist, while representing industry-standard practice, did not prevent the exploit. This does not necessarily indicate negligence on the part of the auditors — the specific state-sequencing issue may not have been covered by existing test cases — but it does underscore the limits of static audit coverage for complex lending protocol logic. Users and depositors should weigh the protocol's post-exploit remediation claims against the absence of a published, comprehensive post-mortem that maps each audit finding to its resolution status. ZachXBT, the blockchain investigator, flagged this entity as part of broader monitoring of DeFi exploits and suspicious on-chain activity.","heading":"Broader Risk Assessment","sources":[{"url":"https://medium.com/coinmonks/how-a-200k-exploit-unfolded-at-unilend-04fb4918292d","name":"medium.com","type":"other","credibility":3},{"url":"https://blog.solidityscan.com/unilend-finance-hack-analysis-5ac7bb71850d","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://olympix.security/biweekly-exploits/unilends-sequencing-bug-orange-finances-key-leak-and-labubus-transfer-logic-fail","name":"olympix.security","type":"other","credibility":3},{"url":"https://t.signalplus.com/crypto-news/detail/unilend-hack-contract-vulnerability-197k-loss","name":"t.signalplus.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020","event":"UniLend Finance founded by Chandresh Aharwar, Tarun Malik, and Suryansh Kumar.","source":"","date_original":"2020-01-01"},{"date":"2021-03-14","event":"UFT token reaches all-time high of approximately $3.77 USD.","source":""},{"date":"2024-02-12","event":"UniLend V2 launches on Ethereum mainnet as the first permissionless lending and borrowing protocol for all ERC-20 tokens, following audits by PeckShield and SlowMist.","source":""},{"date":"2025-01-12","event":"UniLend V2 exploited via flash loan attack exploiting stale health factor calculation logic, resulting in approximately $197,000 in losses from the stETH lending pool. Attacker address: 0x55f5f8058816d5376df310770ca3a2e294089c33.","source":""},{"date":"2025-01-13","event":"UniLend Finance posts official acknowledgment of the exploit on X, confirms $200K loss (~4% of $4.7M TVL), advises against V2 deposits, and confirms V1 funds are safe.","source":""},{"date":"2025-01-13","event":"SlowMist publishes technical post-mortem identifying stale balance reads in checkHealthFactorLtv0 and checkHealthFactorLtv1 as root cause.","source":""},{"date":"2025-01-13","event":"UniLend Finance offers the attacker a 20% bounty (~$40,000) for return of stolen funds; no public confirmation of recovery reported in subsequent sources.","source":""}],"sources_used":[{"url":"https://unilend.medium.com/unilend-v2-is-now-live-5b3d76831bf6","name":"unilend.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://techbullion.com/unilend-v2-launched-on-mainnet-first-ever-permissionless-lending-borrowing-protocol-for-all-digital-assets/","name":"techbullion.com","type":"other","archive_url":"https://web.archive.org/web/20260829120112/https://techbullion.com/unilend-v2-launched-on-mainnet-first-ever-permissionless-lending-borrowing-protocol-for-all-digital-assets/","credibility":3,"archive_timestamp":"2026-08-29T12:01:12+00:00"},{"url":"https://coinmarketcap.com/currencies/unilend/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260419090510/https://coinmarketcap.com/currencies/unilend/","credibility":3,"archive_timestamp":"2026-04-19T09:05:10+00:00"},{"url":"https://slowmist.medium.com/analysis-of-the-unilend-hack-90022fa35a54","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251129164449/https://slowmist.medium.com/analysis-of-the-unilend-hack-90022fa35a54","credibility":3,"archive_timestamp":"2025-11-29T16:44:49+00:00"},{"url":"https://medium.com/coinmonks/how-a-200k-exploit-unfolded-at-unilend-04fb4918292d","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/defi-protocol-unilend-finance-exploited-for-197000/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260510150428/https://crypto.news/defi-protocol-unilend-finance-exploited-for-197000/","credibility":3,"archive_timestamp":"2026-05-10T15:04:28+00:00"},{"url":"https://www.the-blockchain.com/2025/01/13/unilend-finance-losses-197-6k-to-a-redeem-process-vulnerability-exploit/","name":"the-blockchain.com","type":"other","archive_url":"http://web.archive.org/web/20260608211721/https://www.the-blockchain.com/2025/01/13/unilend-finance-losses-197-6k-to-a-redeem-process-vulnerability-exploit/","credibility":3,"archive_timestamp":"2026-06-08T21:17:21+00:00"},{"url":"https://unilend.medium.com/a-deep-dive-into-unilend-v2s-security-c1b95d2439f5","name":"unilend.medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.scribd.com/document/860759163/PeckShield-Audit-UniLendV2","name":"scribd.com","type":"other","archive_url":"http://web.archive.org/web/20260205104315/https://www.scribd.com/document/860759163/PeckShield-Audit-UniLendV2","credibility":3,"archive_timestamp":"2026-02-05T10:43:15+00:00"},{"url":"https://unilend.gitbook.io/unilend-finance/audit-report","name":"unilend.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20260511202550/https://unilend.gitbook.io/unilend-finance/audit-report","credibility":3,"archive_timestamp":"2026-05-11T20:25:50+00:00"},{"url":"https://www.vibraniumaudits.com/post/unilend-finance-exploited-for-nearly-200-000","name":"vibraniumaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260609122505/https://vibraniumaudits.com/post/unilend-finance-exploited-for-nearly-200-000","credibility":3,"archive_timestamp":"2026-06-09T12:25:05+00:00"},{"url":"https://x.com/UniLend_Finance/status/1878805205254340844","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coinspeaker.com/unilend-finance-suffers-196200-loss-vulnerability-exploit/","name":"coinspeaker.com","type":"other","archive_url":"http://web.archive.org/web/20260215021324/https://www.coinspeaker.com/unilend-finance-suffers-196200-loss-vulnerability-exploit/","credibility":3,"archive_timestamp":"2026-02-15T02:13:24+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=unilend-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20251110070151/https://www.web3isgoinggreat.com/?id=unilend-exploit","credibility":3,"archive_timestamp":"2025-11-10T07:01:51+00:00"},{"url":"https://defillama.com/protocol/unilend-v2","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250910013456/https://defillama.com/protocol/unilend-v2","credibility":3,"archive_timestamp":"2025-09-10T01:34:56+00:00"},{"url":"https://www.gate.com/learn/articles/the-200k-dollars-uni-lend-hack-what-went-wrong-and-how-de-fi-can-do-better/5931","name":"gate.com","type":"other","archive_url":"https://web.archive.org/web/20260829050222/https://www.gate.com/learn/articles/the-200k-dollars-uni-lend-hack-what-went-wrong-and-how-de-fi-can-do-better/5931","credibility":3,"archive_timestamp":"2026-08-29T05:02:22+00:00"},{"url":"https://blog.solidityscan.com/unilend-finance-hack-analysis-5ac7bb71850d","name":"blog.solidityscan.com","type":"other","archive_url":"https://web.archive.org/web/20260829224827/https://blog.solidityscan.com/unilend-finance-hack-analysis-5ac7bb71850d/","credibility":3,"archive_timestamp":"2026-08-29T22:48:27+00:00"},{"url":"https://olympix.security/biweekly-exploits/unilends-sequencing-bug-orange-finances-key-leak-and-labubus-transfer-logic-fail","name":"olympix.security","type":"other","archive_url":"http://web.archive.org/web/20260416115040/https://olympix.security/biweekly-exploits/unilends-sequencing-bug-orange-finances-key-leak-and-labubus-transfer-logic-fail","credibility":3,"archive_timestamp":"2026-04-16T11:50:40+00:00"},{"url":"https://t.signalplus.com/crypto-news/detail/unilend-hack-contract-vulnerability-197k-loss","name":"t.signalplus.com","type":"other","archive_url":"https://web.archive.org/web/20260829230936/https://t.signalplus.com/crypto-news/detail/unilend-hack-contract-vulnerability-197k-loss","credibility":3,"archive_timestamp":"2026-08-29T23:09:36+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:26.161372+00:00","updated_at":"2026-08-29T23:26:13.107104+00:00"}}