Float Protocol suffered a flash loan attack, resulting in a loss of approximately $28,000

According to Slow Mist monitoring, Float Protocol suffered a flash loan attack, resulting in a loss of approximately $28,000 (10.71 ETH). The attacker manipulated the Uniswap V3 spot price (slot0) through a flash loan, leading to incorrect pricing of LP shares in the Hypervisor contract, with key functions lacking TWAP/oracle verification and slippage protection mechanisms.

The attacker distorted the values of currentTick() and getTotalAmounts() by making large trades in the V3 liquidity pool, then repeatedly deposited and withdrew the inflated share value to arbitrage.