Float Protocol's pool on RariCapital was exploited through oracle manipulation of the FLOAT/USDC Uniswap V3 pool. Insufficient liquidity in the pool allowed an attacker to create a fake position marking FLOAT at trillions of USDC per token. The exploited Uniswap V3 oracle reported this manipulated price, allowing the attacker to use FLOAT as infinite collateral to borrow all available assets.

The attackers withdrew approximately 350 ETH (equivalent to $1.1 million) from Float Protocol’s Rari Capital pool. The reason is that Uniswap V3 FLOAT/USDC oracles lack liquidity, which allows attackers to manipulate the price in the pool and then deposit at a higher interest rate. The hackers returned about $250,000 for some reason.