Two transactions. That’s all it took. On block 18,442,311, a flash loan of 50,000 ETH was split across seven addresses, each one minting shares in Float Protocol’s new cross-chain lending pool. The ninth decimal place in the share calculation — a rounding error of 0.000000001 — turned a $200,000 deposit into $12 million in borrowable liquidity. Total loss: $40 million in under 90 seconds. And the market yawned. Because this was not a hack. It was arithmetic. And arithmetic is law.
Let me be clear: I cut my teeth auditing ERC-20 contracts during 2017’s ICO circus. I found integer overflows in CryptoGem’s token before the rug pull. So when I see a precision loss exploit, I smell something deeper than a misplaced decimal. Float Protocol was the darling of Q3 2024 — $200 million TVL, a $120 million governance token market cap, and a team that swore they had audited every line. They had. Three audits from Tier-1 firms. Yet the bug was hiding in plain sight: a division by 10^18 before multiplication, causing truncation in the share minting formula.
Greeks don’t care about your audits. The Greeks — delta, gamma, theta — they measure risk. But in DeFi, the real Greek is rounding error. The attacker understood that a $50,000 deposit would round down to zero shares if the total supply was large enough. So he manipulated the supply first. A simple flash loan to inflate the pool, then his minimal deposits minted millions of shares. Code is law, but bugs are justice. The justice here is that the protocol’s own token holders paid for the arrogance of assuming integer math is safe.
The Context: Float’s Promise vs. Float’s Mechanism
Float launched in late 2024 as a "non-custodial, uncollateralized lending layer" — a fancy way of saying you could borrow without overcollateralization if you staked their governance token, FLOAT. The thesis was simple: trust the community, not collateral. In practice, it meant that FLOAT holders could vote on credit limits and interest models. The system used a unique "share-based" accounting, where each deposit into a lending pool minted shares proportional to the pool’s total value. The formula was: