Team Finance's migrate function, which moves locked LP positions from Uniswap v2 to v3, never validated that token and pair parameters matched the caller's lock. On 27 October 2022, an attacker locked a worthless token, then used another user's lock parameters to move that liquidity into an attacker-controlled v3 pair at a skewed price. Four locked projects lost ~$15.8M for $2,700 of attacker capital.

Team Finance tweeted that the protocol’s management funds were hacked during the migration from Uniswap v2 to v3, with an identified loss of approximately $14.5 million worth of tokens. On October 31, the Team Finance white hat hacker address has returned $13.4 million in digital assets, including 548.7 ETH ($860,000) to FEG, 765,000 DAI and 11.8 million TSUKA ($626,000) to Tsuka, about 5 million DAI and 74.6 trillion CAW (~$5.5 million) to CAW, 209 ETH ($328,000) to KNDX, smithbot.eth has returned 263 billion KNDX ($292,000) to KNDX.