Kolan Uniswap V4 hook accept() sandwich (2026-10-15) — attacker EOA and attack contract
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Reported: 2026-10-15
- Last updated: 2026-10-16
Kolan ($KLN) Uniswap V4 hook exploit on Ethereum on 2026-10-15 (~11:06 UTC). Attacker flash-borrowed 6.7 WETH from Balancer, inflated KLN spot price, permissionlessly called KolanHook.accept() twice so the hook spent ~2.31 ETH of its own treasury buying KLN at the manipulated price, then sold KLN back for ~1.28 ETH net profit (~$3,025). Root cause: permissionless buyback at manipulable spot price (no TWAP/slippage/caller restriction). Sources: oculr report linked from https://x.com/oculrxyz/status/2110818460565725554 ; ExVul https://x.com/exvulsec/status/2110708025753481600 ; DefimonAlerts…
Other addresses in this report: 0x8df735014eab81905e76b87ef0c069bd8e0ae382