Immunefi's head of security Gonçalo Magalhães explained that the UNCX Vesting V2 contract failed to keep its share counters consistent when users withdrew vested tokens and canceled positions, and that the smart contract failed to ensure no functions could break the invariant around the shares' global counter.