On August 5, 2026, Unistreets on Ethereum was exploited via an arbitrary external call vulnerability, resulting in a loss of approximately $17,750. The exploiter address and transaction were identified on-chain.

Unistreets LaunchpadFactoryAuto contract on Ethereum was exploited via arbitrary calldata injection. The factory custodied all launched tokens’ Uniswap V4 LP NFTs; the attacker injected setApprovalForAll approval and burned multiple LP positions, draining liquidity for a loss of approximately $17,750.