ETHMACOAPY’s actualizeFee() rounded redemption backing upward even when no fee was payable. Attackers donated collateral to trigger recalculation, temporarily acquired Set tokens, then redeemed them for more collateral than they contributed, with the difference coming from existing holders’ backing. Two separate EOAs repeated the process across two transactions, draining approximately 8.11 WETH

The attacker abused Set Protocol’s actualizeFee(). Even though no fee was minted, the function rounded unitShares upward from 4,927 to 4,928. The attacker issued shares before the update and redeemed the same quantity afterward, extracting extra collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit.