EVM Transaction Triage · Ethereum Mainnet

Uniswap Firepit fee buyback — a keeper, not an attacker

tx 0x833d9556b4b8c996f537f10fb77c8e9dfa3bdc485830692d5793b8eec288a8be
Chain 1 (Ethereum) Triaged 2026-07-22 Trace fully decoded, no gaps
NOT A HACK confidence: HIGH

A searcher/keeper bot permissionlessly executed Uniswap's official Firepit.release() fee-auction. It burned 4,000 UNI to claim accumulated protocol fees — an intended protocol operation, not value theft.

The bottom line

Keeper net profit
~$6 0.003 ETH
UNI burned to 0x…dead
4,000 ≈ $15.2k
Fees released (by design)
≈ $14.3k ~16 tokens
Unexplained victim
None

Net value changes

Address / roleNet changeUSDInterpretation
0x0000…deadBurn address +4,000 UNI +$15,240 burned — a cost
TokenJarUniswap fee vault −USDC/USDT/WETH/WBTC
+ ~12 long-tail tokens		 ≈ −$14,300 released by design
UniswapV3 / v4 poolsDEX liquidity tokens in / WETH out ~0 routing
FewWrappedTokenfew.wtf wrapper −1,812.5 UNI / +3.57 WETH ~0 unwrap artifact
0x4838b1…5f97Builder / coinbase tip +0.0095 ETH +$18 block tip
0xfeefee…69d3Keeper operator EOA +0.0031 ETH +$6 realized profit

Mechanism

  1. EOA 0xfeefee…69d3 calls its keeper contract 0x428c34…58ba.
  2. Keeper takes a 20 WETH flash loan from Morpho (flashLoan → onMorphoFlashLoan).
  3. With the borrowed WETH it buys exactly 4,000 UNI across every venue to minimize slippage — Uniswap V2, V3, v4 PoolManager, and few.wtf wrapped-UNI (then unwrapped).
  4. Reads Firepit.threshold() / nonce(), calls the fee adapter's collect(), and approves 4,000 UNI to the Firepit.
  5. Calls Firepit.release(1089, [assets…], recipient): the 4,000 UNI threshold is sent to the hardcoded recipient 0xdead (burned), and in exchange TokenJar releases its accumulated protocol-fee tokens to the keeper.
  6. Keeper sells all released fee tokens back to WETH/USDC through Uniswap V3.
  7. Repays the 20 WETH flash loan to Morpho, unwraps leftover WETH, tips the builder, and keeps the tiny ETH remainder as profit.

Key addresses

Uniswap Firepit
0x0d5cd355e2abeb8fb1552f56c965b867346d6721
Official protocol-fee ExchangeReleaser. Recipient hardcoded to 0xdead. Security contact security@uniswap.org.
TokenJar
Uniswap per-chain fee vault
Holds accumulated protocol fees; assets only leave when UNI is burned via Firepit. The "big loser," drained by design.
Keeper contract
0x428c347647e16855797e070c031e53787c3b58ba
Third-party searcher/integrator that orchestrates the buy → burn → release → sell. Transient balances only.
Keeper operator (EOA)
0xfeefee…69d3
Transaction sender. The feefee vanity prefix is consistent with an MEV/fee bot.
V3OpenFeeAdapter
0xf2371551fe3937db7c750f4dfabe5c2fffdcbf5a
Uniswap fee source/adapter read during the release.
UNI token / burn
0x1f9840…f984 → 0x000…dead
4,000 UNI moved from keeper to the burn address as the cost of the release.

Evidence

  • Verified source: the Firepit is an ExchangeReleaser with recipient hardcoded to 0xdead and Uniswap's security contact. release() transfers the UNI threshold to burn, then TOKEN_JAR.release(assets, recipient) — a permissionless, by-design swap.
  • Public docs: 0x0d5cd355…6721 is documented as Uniswap's mainnet Firepit, part of the "UNIfication" fee system launched after the governance fee-switch and 100M UNI burn.
  • Economics: net extraction is only ~$6–24; the 4,000 UNI is burned, not pocketed. TokenJar depletion is the intended function — there is no unexplained victim.

Caveats

  • WETH-unwrap accounting: the FewWrappedToken +3.57 WETH line is a wrapper-unwrap artifact. It does not create phantom keeper profit here — real profit is only the ~0.003 ETH remainder — so the known unwrap-accounting issue does not affect this verdict.
  • Heuristic note: the usual "largest loser = victim / largest gainer = attacker" rule does not flag an exploit here, because both endpoints (TokenJar out, 0xdead in) are explained by protocol design.

Sources

docs.uniswap.org — Firepit technical reference docs.uniswap.org — Protocol fees overview github.com/Uniswap/protocol-fees blog.uniswap.org — UNIfication openzeppelin.com — UNIfication fees audit etherscan.io — Firepit contract