KolanHook: A Flash Loan, Two Hook Payments, and the Limits of the Trace

On 15 October 2026, a single Ethereum transaction moved 2.309861111111111114 ETH out of KolanHook and ultimately paid 1.279914429958618589 ETH to its initiating address, according to the body of SentinelTX report CASE-ASYNC95E. Those figures describe different things. The first is the hook's gross native-ETH outflow; the second is the surplus paid after borrowed principal was returned.

That distinction is the starting point for understanding this case. The transaction also involved a 6.7 WETH flash loan and a larger Pool Manager payout. Treating every transfer as a separate loss, or calling the entire payout profit, would misrepresent the reported flows.

This article adapts the report's findings for the ChainBounty community. It preserves the distinction between recorded movements and the report's interpretation of the mechanism. It also explains the source's scope and evidentiary limits.

The incident ledger: follow the amounts separately

The report's body places the successful transaction at 11:06:11 UTC on 15 October 2026, in Ethereum block 26197504. It reports 78 call frames and a maximum call depth of eight. The seed transaction and relevant full addresses appear in the reference key below. [1]

The seed-transaction ledger is:

• Borrowed principal: 6.7 WETH, unwrapped into 6.7 ETH.
• Principal returned: 6.7 ETH re-wrapped into WETH and repaid within the same transaction.
• First hook payment to the Pool Manager: 2.050000000000000001 ETH.
• Second hook payment to the Pool Manager: 0.259861111111111113 ETH.
• Combined hook native outflow: 2.309861111111111114 ETH.
• Pool Manager payout to the helper: 7.979914429958618589 ETH.
• Gross surplus paid by the helper to the initiator: 1.279914429958618589 ETH.
• Maximum transaction-fee estimate: 0.000487737331891920 ETH.
• Gas-adjusted proceeds: at least 1.279426692626726669 ETH.

The payout reconciles exactly as reported: 7.979914429958618589 ETH minus 6.7 ETH equals 1.279914429958618589 ETH. The hook outflow is larger than that surplus. The report attributes the difference to netting against swap legs inside the Pool Manager; these categories should remain separate.

The gas-adjusted amount is a lower bound, not an exact net-profit figure. The report multiplies the gas limit of 3,105,267 by the gas price of 157,067,760 wei to obtain a fee ceiling. It does not provide the seed transaction's gasUsed in the cited evidence. [2]

Figure 1. Zero-baseline comparison of hook native outflow and initiator gross surplus. The repaid 6.7 WETH principal is a separate annotation. The two bars measure different things and are not additive; the exact ledger above governs any shortened chart labels.

How the transaction unfolded

The report describes Kolan as a fixed-supply KLN token whose supply sits in a native-ETH/KLN Uniswap v4 pool. In the published design summarized by SentinelTX, the hook is the sole liquidity provider. Buyers pay a premium for a cancellation “window,” during which a purchase can be cancelled and ETH refunded. This design context comes from the report, rather than a separate review of the protocol's code. [3]

The reported execution sequence has five useful stages:

1. Deployment. The initiating address created an operation contract, which created a helper contract. The helper carried out the interactions.
2. Funding. The helper borrowed 6.7 WETH from the address labelled Balancer, then unwrapped it into ETH.
3. Initial pool interaction. The helper entered the Uniswap v4 Pool Manager and paid it 6.7 ETH. The Pool Manager invoked KolanHook callbacks.
4. Repeated hook calls. The helper called the hook twice using selector 0x19b05f49. The first call triggered four Pool Manager calls with selector 0x5a6bcfda; the second triggered seven. The hook made the two ETH payments listed above during these hook-driven frames.
5. Exit and repayment. The helper interacted with the Pool Manager again, received 7.979914429958618589 ETH, re-wrapped and returned the 6.7 ETH principal, then paid the remaining 1.279914429958618589 ETH to the initiator. [2]

SentinelTX assesses this pattern as consistent with flash-loan-funded price-and-liquidity manipulation of the hook's internal accounting. Its interpretation is that the initial swap displaced the pool price, the hook interactions changed liquidity placement or withdrawal around that price, and the reverse swap captured a difference.

That is an assessment, not a fully decoded root-cause demonstration. The report says selectors were not ABI-decoded. It cannot establish whether 0x19b05f49 represents buy, cancel or accept, or whether 0x42966c68 is a burn. The broader classification as a logic/accounting exploit rather than a key compromise is also the report's assessment. A decoded trace and relevant hook events remain important missing evidence. [3]

Figure 2. Five-stage incident sequence, from deployment and funding through pool and hook interactions to repayment and surplus. The sequence is reported evidence; the proposed accounting mechanism remains an assessment. Pre-incident transfers do not belong in this flow.

Where the traced value stopped

Section 7 names the initiating address as the endpoint in the traced set: one inbound movement and no outbound movement in that set. The body also says the initiator's transaction list was read to its end and no later outbound value transfer was identified as of the analysis. No exchange-deposit leg was identified. These are bounded findings, not a guarantee about future activity. [4]

A later contract-creation transaction at 16:48:59 UTC on 15 October is described separately. It involved other contracts and no KolanHook value-bearing frame. Its proceeds are excluded from this incident ledger.

The initiator's displayed native balance was 1.539598 ETH at analysis time. Appendix A gives the full address-level reconciliation as 1.539598271282627379 ETH. That balance combines unrelated activity; it is not an isolated balance of Kolan proceeds. Similarly, the report's 0.0 ETH native-balance reading for the hook does not establish its total assets or liabilities, because KLN and Pool Manager claim balances were not read. [4]

Earlier transfers are context, not the exit route

The report records three 1 ETH transfers to an address labelled Tornado.Cash Router and DAI/PAXG transfers to an address labelled Relay.link on 12 October. They happened three days before the seed transaction. They cannot be an onward route for proceeds generated on 15 October.

Some source figures combine incident flows with earlier or unrelated activity. Visual proximity and connecting arrows should not override chronology. This article does not adopt the report's sanctions tag as a statement of current legal status, and does not infer a real-world identity or insider involvement from the address history. [5]

Important limits inside the source

The abstract limits its statements to the evidence available to that summary: it does not supply a transaction date or record terminal endpoints, and its definition of “verified” does not establish the signer. The body separately gives the incident date, block and reported tx.from address (§§1 and 3), and lists the initiator as an endpoint within the traced set (§7). These are different levels of scope and detail, not competing dates or proof of a final cash-out destination. This article attributes the specific transaction details to the body and preserves the source's limits on identity, ownership and onward tracing.

The abstract also defines “verified” narrowly: the transaction was retrieved and names the addresses. It explicitly says that this does not establish authorization, ownership or even that a reported asset symbol identifies the intended asset. That label should not be read as independent confirmation of every narrative claim.

Appendix A records an executed query from 15 September 2026 at 11:43:17.968656 UTC to 16 October 2026 at 11:43:17.968656 UTC. Of 51 retained movement rows, 44 lack readable timestamps. The seven timestamped rows span 22 September to 12 October; separately, the body supplies the incident timestamp. Query bounds are not proof of continuous transaction coverage or enforcement of a requested historical cutoff. The report also leaves KLN quantities and the impact on individual window holders unquantified. [6]

The community takeaway

The useful conclusion is specific: SentinelTX reports a repaid 6.7 WETH loan, two hook payments totaling 2.309861111111111114 ETH, and a 1.279914429958618589 ETH surplus payment to the initiator in one transaction. The proposed manipulation mechanism needs decoding; the traced endpoint does not establish a later cash-out route.

For community reporting, retain those boundaries. A stronger explanation would require the decoded hook calls and WindowOpened, WindowClosed and Taxed events identified by the report. Until then, the exact ETH ledger is more informative than a single dramatic “loss” number, and the unanswered questions belong alongside the findings.

Figure 3. Reported movements, assessed mechanism, unresolved impact. No later cash-out route or real-world identity is established by this adaptation.

Reference key and source notes

Seed transaction: 0x7b131926e6f06491ae1aead3e419b208c8aa70ed7898e8c5a33d9f52e40915a9

Initiator / reported tx.from: 0x8df735014eab81905e76b87ef0c069bd8e0ae382

KolanHook: 0x0136fecf49e0217bfd2d9551e8e7b05f174ba8ec

Helper: 0x4d6a41f2b80fe75facf27f9d0b3dc8bd0ebc835f

Operation contract: 0xebea460c6496e1a2565aab488eb005473bde5f79

Uniswap v4 Pool Manager: 0x000000000004444c5dc75cb358380d2e3de08a90

Balancer-labelled lender: 0xba12222222228d8ba445958a75a0704d566bf2c8

WETH: 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2

Adapted from SentinelTX report CASE-ASYNC95E, generated 16 Oct 2026; findings and limitations as of that report.

Source sections: [1] §1 and §3B; [2] §3B and §3D; [3] §1 and §5; [4] §1, §3C, §7 and Appendix A; [5] §3A and source-figure captions; [6] Abstract, §3D and Appendix A.

Explorer links are reader-navigation links constructed from the report's exact identifiers. Explorer content was not used as an additional factual source. This adaptation does not claim independent verification of the report's evidence signature.