Summer.fi, Lumi Finance, Drips Network: $6.3M Lost to Assumptions Nobody Tested
Three exploits this week, $6.3M gone. Most of that total was Summer.fi, where the manipulable value lived in operational state during a strategy offboarding — the kind of thing code analysis alone doesn't own.
But the other two are the ones worth sitting with. Both came down to code trusting a number it shouldn't have: a validation step that quietly did more than validate, a cast that silently changed a value. An assumption that held in the happy path and broke the moment someone pushed on it. Neither is novel, and both are exactly the kind of property you can assert and test before a line reaches mainnet.
Audits check the code someone thought to question. Invariant testing checks the assumptions the code is silently making. That's the whole idea behind Olympix: surface the broken assumption in the dev loop, so it stays a line in a report instead of a headline.
In Brief
Summer.fi lost $6.04M due to a vault NAV that could be inflated by donating stale-valued tokens into a capped-but-still-counted strategy, pumping the share price.
Lumi Finance lost $264K due to an ERC-4337 validation flaw that let an attacker-controlled paymaster grant token approvals during validation, with no user intent.
Drips Network lost $24.9K due to an unsafe uint128-to-int128 cast in give() that flipped the sign and reversed the transfer direction, draining the reserve.
Summer.fi | Amount Lost: $6.04M
On July 6th, the Summer.fi exploit on Ethereum drained about $6.04M from two Lazy Summer Protocol USDC vaults. The root cause was manipulation of the vault net asset value through the FleetCommander's totalAssets() accounting. During the offboarding of an old strategy, a Silo-based Ark was capped but remained included in the vault's NAV calculation while holding stale-valued Silo vault tokens (Silo: Varlamore USDC Growth).
The attacker accumulated those stale-valued tokens over roughly three months, then in a single atomic transaction funded by a ~$65.4M Morpho flash loan, donated them into the still-counted Ark to inflate totalAssets() and the vault share price, deposited ~$64.8M, and redeemed ~$70.9M, netting ~$6M which was swapped to DAI and sent to the attacker. Key or admin compromise was ruled out by researchers.
On July 13th, the Lumi Finance exploit on Arbitrum drained about $264K from multiple ERC-4337 smart accounts. The root cause was a validation-phase side-effect flaw in Lumi's smart-account logic. In ERC-4337, UserOperation validation must not cause state changes, but Lumi's validation logic let an attacker-controlled paymaster trigger ERC20 approval operations during the validation phase. So merely validating a UserOp granted the attacker allowances from victim smart accounts with no explicit user intent. The attacker then used a sweeper contract to batch-drain the approved tokens across many accounts, primarily LUA and USD₮0, swapped them to ETH, and sent the proceeds out. No user signed these approvals and no key was compromised. The invariant broken is the core ERC-4337 rule that validation is read-only in effect and cannot grant approvals.
On July 14th, the Drips Network exploit on Ethereum drained 24,882.99 DAI (about $24.9K) from the DaiReserve. The root cause was an unsafe integer cast in DaiDripsHub.give(address,uint128), which converts a uint128 amt to int128 without validating amt <= type(int128).max.
The attacker passed 2^128 - reserveBalance, so the cast produced a negative int128, and negating it yielded a positive value that inverted the transfer direction, turning "user pays the reserve" into "reserve pays the user." A single crafted give() call drained the reserve, with the DAI routed from the DaiReserve through the Hub proxy and the attack contract to the attacker. A near-identical, much smaller instance hit Drips on Polygon 27 minutes later for about 108 DAI.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Follow-up: Conduct a follow-up review to ensure that the remediation steps were effective and that the smart contract is now secure.
Follow-up: Conduct a follow-up review to ensure that the remediation steps were effective and that the smart contract is now secure.
In Brief
Remitano suffered a $2.7M loss due to a private key compromise.
GAMBL’s recommendation system was exploited.
DAppSocial lost $530K due to a logic vulnerability.
Rocketswap’s private keys were inadvertently deployed on the server.
Hacks
Hacks Analysis
Huobi | Amount Lost: $8M
On September 24th, the Huobi Global exploit on the Ethereum Mainnet resulted in a $8 million loss due to the compromise of private keys. The attacker executed the attack in a single transaction by sending 4,999 ETH to a malicious contract. The attacker then created a second malicious contract and transferred 1,001 ETH to this new contract. Huobi has since confirmed that they have identified the attacker and has extended an offer of a 5% white hat bounty reward if the funds are returned to the exchange.
