Summer Finance Loses $6M in Flash Loan Vault Exploit

DeFi News

A DeFi yield-optimization protocol known as Summer Finance, or Summer(dot)fi, was drained of $6 million on July 6 after an attacker manipulated how the protocol calculated assets inside its vaults. Blockchain security firm Blockaid detected the breach early that morning and flagged it publicly, prompting other on-chainanalysts to investigate.

The protocol runs an automated system called the Lazy Summer Protocol, which uses AI keepers to allocate and rebalance user deposits across multiple lending platforms in search of higher returns. The attacker exploited the accounting logic at the core of this system to withdraw more funds than they had deposited.

Attacker Used $65.4M Flash Loan To Manipulate Vaults

According to blockchain security firm CertiK, the attacker borrowed $65.4 million through a flash loan and deposited $64.8 million into the protocol. By distorting the totalAssets() function used by a smart contract called Fleet Commander, they redeemed $70.9 million, netting a $6 million profit. Fleet Commander is responsible for managing the protocol’s vaults and calculating their values.

The distortion was made possible through a second component called the Ark, which connects each vault to an underlying lending protocol. CertiK said the attacker had accumulated a position in the Silo: Varlamore USDC Growth vault in advance, then donated assets to the Ark between transactions to skew the accounting figures Fleet Commander relied on.

Security firm Cyvers separatelyidentified the attack vector as a share accounting vulnerability exploited through price manipulation. After completing the exploit, the attacker converted the stolen funds into DAI stablecoins and moved them to an address under their control

Summer(dot)fi Has Not Confirmed the Exploit Officially

Summer(dot)fi had not issued a confirmation through its official channels at the time of reporting, and the root cause had not been officially verified.

Related Article: Crypto Exploit Losses Drop 90% in May to Ethereum 68.3M, Says Certik

Flash loan attacks require no upfront capital from the attacker, as the borrowed funds are taken and returned within a single transaction. The accounting distortion in this case allowed the attacker to extract more value than they put in before the loan was settled.

This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.

Source: coinmarketcap.com