ExVul security researchers identified an accounting discrepancy in UNCX's VestingManager contract where the release() function reduced total shares without updating original deposit records, enabling wrongful withdrawals.