Summer Finance Pauses Vaults After $65.4M Flash Loan Attack Triggers $6M Loss

Security Firms Flag Breach

Blockchain information firms reported Monday, July 6, a large information breach targeting Summer Finance, a decentralized finance ( DeFi) output optimization protocol. According to real-time onchain analytics flagged by information monitors, the protocol suffered an estimated nonaccomplishment of $6 cardinal from a blase flash indebtedness and terms manipulation attack.

Following the alerts, the Summer Finance squad confirmed the breach, stating:

“We are alert of the reported exploit a small earlier contiguous and are investigating the basal cause. The protocol guardians are presently pausing each Vaults crossed the Lazy Summer Protocol. We volition supply much updates arsenic we person them.”

The exploit progressive a multi-step manipulation of the protocol’s accounting logic. An investigation by blockchain information steadfast Certik revealed that the attacker initiated a $65.4 cardinal flash indebtedness to distort the plus valuation model of the Lazy Summer Protocol vault, which is managed nether Summer.fi.

By exploiting a vulnerability successful the Fleet Commander contract’s plus accounting logic, the attacker artificially skewed however the strategy calculated token value. After depositing astir $64.8 cardinal into the manipulated ecosystem, the histrion executed an arbitrage maneuver to redeem $70.9 cardinal successful assets.

According to Cyvers, the exploiter rapidly swapped the resulting $6 cardinal nett into DAI stablecoins earlier funneling the stolen funds into an attacker-controlled wallet to interruption the insubstantial trail.

While Summer Finance developers analyse the underlying vulnerabilities to merchandise a broad post-mortem report, the incidental highlights a rising trend of complex, infrastructure-level arbitrage manipulation. Meanwhile, information experts urged participants to instrumentality contiguous antiaircraft precautions, including revoking permissions oregon canceling immoderate progressive smart contract approvals tied to the affected Lazy Summer Protocol vaults.

Experts besides advised participants to verify each communications exclusively done authoritative task channels to debar phishing attacks, and to see moving integer assets retired of online “hot” wallets into offline acold retention until the halfway improvement teams spot the underlying protocols.