On 3 August 2021 an attacker exploited Popsicle Finance's Sorbetto Fragola UniswapV3 optimizer pool where share transfers did not update fee-tracking state, allowing the same fee rewards to be claimed multiple times across accounts, draining ~$20.7M.

Popsicle Finance, a multi-chain revenue optimization platform, was attacked. The core of this vulnerability is that the same PLP certificate can bring benefits to multiple holders at the same time node due to the defect in the reward update record.