Team Finance

Team Finance's migrate function, which moves locked LP positions from Uniswap v2 to v3, never validated that token and pair parameters matched the caller's lock. On 27 October 2022, an attacker locked a worthless token, then used another user's lock parameters to move that liquidity into an attacker-controlled v3 pair at a skewed price.

8M for $2,700 of attacker capital.