2026-10-15 · record inc_0014 · updated 2026-10-19
KolanHook: an unbounded buyback settled at a manipulated spot price
A flash loan moved the KLN spot price in the pool the hook owns, then two expired windows were closed, triggering a buyback with no price bound. About 2.31 ETH left the hook; the attacker kept about 1.28 ETH.
Kolan
EthereumComponent: KolanHook, Uniswap v4 hook; accept() and the window buyback
Event: Confirmed on-chainRoot cause: Independent analysisLoss: Independent analysis
This record is not indexed by search engines: it does not yet have a root cause confirmed from a primary source.
Current status
No official statement found.
Timeline
- 2026-10-15 11:06:11 UTCAttack transaction confirmed in block 26,197,504.
- 2026-10-16Public PoC added to a reference repository.
Root cause
Independent analyses agree that accept() could be called by anyone once a window expired and that the buyback used the pool's own instantaneous price with no bound. ThreatWire has not read the contract source.
Basis: independent analysis · verified by us against that source
Classes: Oracle and spot-price manipulation, Flash-loan amplification
Impact: loss and recovery
The hook's own ETH reserves. Small in dollars; the pattern matters.
Reported loss
$3K (2.31 ETH)
USD basis: About $3K at the time (Panda Security). Hook outflow 2.309861 ETH; attacker net 1.279914 ETH after repaying the loan, per the transaction (a reconstruction gives 1.2805).
Recovered or returned
Unknown
No recovery reported.
Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.
Addresses and transactions
Contracts and wallets
- 0x0136fe…4ba8eccontractEtherscan ↗
KolanHook (affected)
Ethereum · victim · Confirmed on-chain · contract code present at the address (read-only)
Transactions
- 0x7b1319…0915a9txEtherscan ↗
attack · block 26,197,504 · 2026-10-15 11:06:11 UTC
Confirmed on-chain · read-only JSON-RPC lookup of the transaction and its block · checked 2026-10-19
Explorer links use the chain we confirmed for each item. Where no explorer is configured, or a chain is not verified, we say so rather than guess.
Associated code
- src/test/2026-10/KolanHook_exp.solShown in full
Public PoC metadata
- Status
- Test or reproduction identified
- Dataset
- SunWeb3Sec/DeFiHackLabs
- Stored commit
- 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
- Directory / file
- src/test/2026-10/KolanHook_exp.sol
- Framework
- Foundry
- Licence
- file UNLICENSED; repository Apache-2.0
- Seen at pin
- yes · retrieved 2026-10-19
- Repository claim
- 1.279453 ETH net to the attacker EOA on Ethereum (surplus 1.279914429958618589 ETH after the 6.7 WETH Balancer flash loan is repaid, minus ~0.00046 ETH gas), draining KolanHook's full 2.309861 ETH of escrowed window funds
- Note
- Reproduction metadata only. ThreatWire has not run it and does not treat a repository entry as proof that anything is exploitable.
Remediation and defensive indicators
No fix or remediation has been published by the project that we could verify.
Defensive lessons from the class
- Estimate what it costs to move each price and compare it with what that price controls.
- Require a minimum number of genuinely independent sources and reject answers below it.
- Do not treat a single-block price as truth.
- Assume any bug that needs capital can be funded for free.
Sources
Independent analysis
Panda Security: KolanHook exploit: unguarded Uniswap v4 buyback drained ETH
Published 2026-10-16 · retrieved 2026-10-19
Independent analysis
Tozvan: KolanHook loses 2.3 ETH in Uniswap v4 exploit
retrieved 2026-10-19
Independent analysis
ChainBounty community / SentinelTX: KolanHook: a flash loan, two hook payments, and the limits of the trace
retrieved 2026-10-19
Media report
Telem: Kolan hook exploited via flash loan and price manipulation
retrieved 2026-10-19
- UNCX Vesting V2: share records and token balance made to disagreeShared class: Flash-loan amplification
Method, uncertainty and corrections
Still unknown
- Whether Kolan has responded
- Whether other windows remain exposed
Where sources disagree
- Loss: 2.31 ETH left the hook; the attacker kept about 1.28 ETH. These measure different things.
- Repository reconstruction gives 1.279453 ETH; the transaction shows 1.279914 ETH.
Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
No corrections recorded since publication.