Kolan Uniswap V4 hook: buyback at manipulated price

Hook drained of 2.31 ETH (~$5.4K); attacker profit ~1.28 ETH (~$3.0K), per Defimon.

Root cause: Per Defimon: the permissionless accept(id) path runs _buyBack(), which swaps the hook's ETH reserves into the pool with no slippage guard (sqrtPriceLimit = MIN_SQRT_PRICE+1).

Timeline, as sourced: Exploit tx 15 Oct 2026 11:06:11 UTC (on-chain); Defimon alert 16:55 UTC.

On 15 October 2026 an attacker drained ETH reserves from KolanHook, the Uniswap V4 hook behind Kolan on Ethereum (transaction (opens in a new tab)). According to Defimon (opens in a new tab), anyone could close an expired window with accept(id), which made the hook swap its own ETH back into the pool with no slippage guard. The attacker flash-loaned 6.7 WETH from Balancer, bought KLN to push the price up, triggered accept(10) and accept(42) so the hook spent about 2.31 ETH buying at the inflated price, then sold the pre-bought KLN into the pool. Defimon puts the hook's loss at 2.31 ETH and the attacker's profit at about 1.28 ETH. No statement from Kolan was found.