Unilend V2
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Problems around it, caused by others | -2.4 |
| Long-running | +10 |
| Sum | 63 |
Score: 63/100 (kept between 0 and 100)
How scoring works →Summary
UniLend V2 is a permissionless DeFi lending and borrowing protocol deployed on Ethereum mainnet in February 2024, designed to support all ERC-20 tokens via isolated dual-asset pools. On January 12, 2025, the protocol suffered a smart contract exploit that drained approximately $197,000 from its stETH pool due to a logic flaw in health factor calculations during the asset redemption process. Despite having been audited by PeckShield and SlowMist prior to launch, the exploited vulnerability was not caught or fully remediated, and as of the last available reporting the attacker's 20% bounty offer had not yielded a fund recovery.
Connected Entities
4 entities · 60 linked investigations- Binance→mentioned with→Ethereum(65%)
- Uniswap→mentioned with→Ethereum(80%)
- Unilend V2→mentioned with→Ethereum(80%)
- Unilend V2→mentioned with→Binance(60%)
- Unilend V2→mentioned with→Uniswap(60%)
Timeline(7 events)
2020
UniLend Finance founded by Chandresh Aharwar, Tarun Malik, and Suryansh Kumar.
14 March 2021
UFT token reaches all-time high of approximately $3.77 USD.
12 February 2024
UniLend V2 launches on Ethereum mainnet as the first permissionless lending and borrowing protocol for all ERC-20 tokens, following audits by PeckShield and SlowMist.
12 January 2025
UniLend V2 exploited via flash loan attack exploiting stale health factor calculation logic, resulting in approximately $197,000 in losses from the stETH lending pool. Attacker address: 0x55f5f8058816d5376df310770ca3a2e294089c33.
13 January 2025
UniLend Finance posts official acknowledgment of the exploit on X, confirms $200K loss (~4% of $4.7M TVL), advises against V2 deposits, and confirms V1 funds are safe.
13 January 2025
SlowMist publishes technical post-mortem identifying stale balance reads in checkHealthFactorLtv0 and checkHealthFactorLtv1 as root cause.
13 January 2025
UniLend Finance offers the attacker a 20% bounty (~$40,000) for return of stolen funds; no public confirmation of recovery reported in subsequent sources.
Decision Log
- slot 455366905 · hash RQUzR1pxH71wDC7ctxRe2u2kFzTEJijwYZhasukDmbk
- slot 422977559 · hash DmbrQj82gVomKTfSrGaESi25EsG4MJKdABanWdJW7Pd2
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 15 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:26 AM
last updated: 10/10/2026, 6:47:01 PM
5 viewsavoid.net — verified advice for a post-truth world