GoonFi's $254K Loss and How Olympix Would Have Prevented It

Loss

Exploit date

March 28, 2026

For most of March 28, 2026, GoonFi V2's WSOL/USDC market quoted SOL somewhere around $82.70, close to where the rest of Solana was trading it. Then, within a single second, the price it was willing to sell at dropped to about $2.66. At 12:44:04 UTC a searcher paid 4,096 USDC into the pool and walked out with 1,539.27 WSOL, then sold that WSOL on BisonFi for 127,286.03 USDC in the same transaction.

That one trade cleared roughly $123,000. By the time the program was halted, the WSOL/USDC pool had lost about $254,000, according to MixBytes. The researcher Cetipo, who flagged it on X, put the drain at about $250K and wrote that the program was now halted, likely because of a misconfiguration or a bug. Nobody needed a flash loan, an exotic instruction or a clever exploit contract. The program accepted a price that was off by a factor of 30 and kept trading on it.

A Market Maker That Quotes From a Feed

GoonFi V2 is a proprietary AMM, the kind of Solana program where a single operator quotes prices from its own inventory instead of letting a constant-product curve set them. That design lets the operator keep quotes tight and react to the market quickly, and it puts a lot of weight on the numbers the program prices from.

According to MixBytes, the affected market priced swaps from an external feed that carried two sides of a quote, a bid-like value and an ask-like value. When a trader swaps, the program reads that feed and settles the trade at the quoted price. As long as the feed tracks the real market, the pool behaves like a well-run desk. The program's job is to turn the feed into fills. The question this incident raises is what the program does when the feed stops making sense.

Thirty Times Too Cheap in One Second

MixBytes traced the feed's values on-chain. It was publishing normal SOL/USDC-like values around 82.7, then suddenly wrote a quote around 2.658, and later degraded to near-zero and eventually zero. The exploit transaction lines up with that window exactly: 4,096 USDC for 1,539.27 WSOL works out to about $2.66 per WSOL.

The swap instruction didn't object. There was no check on how far a fresh quote could move from the last one, no floor on what an active SOL market could quote, and no rule that a zero price means stop trading. Every trade that arrived while the bad quote was live settled at it. Searchers bought WSOL far below market and unwound it elsewhere, which is what the BisonFi leg of the traced transaction shows.

MixBytes is careful about cause. Its analysis says the on-chain evidence doesn't show that the searchers caused the bad price, and public sources don't explain where the feed's off-chain input came from. That leaves two layers to the incident. Something upstream produced a pathological quote. The program, which is the part that held the money, accepted it.

Why the Missing Bound Is the Bug

Feeds break. Keepers crash, operators fat-finger values, upstream sources glitch, and a quote that should read 82.7 can come through as 2.658 for reasons that have nothing to do with an attacker. A pricing program that settles real trades has to assume that'll happen eventually, and the defense is cheap. MixBytes spells out the rule of thumb: a jump of more than 30 times inside the same second should trip a circuit breaker, and an active market should refuse near-zero and zero quotes outright.

Any one of those guards would have shrunk this loss to almost nothing. A maximum per-update move would have rejected the 2.658 quote the moment it landed. A sanity floor tied to recent prices would have refused to sell SOL for a few dollars. A zero check would at least have stopped the bleed once the feed hit bottom. GoonFi's swap path had none of them, so the size of the loss was set by how much WSOL the pool held and how fast searchers could reach it.

The pattern isn't unique to Solana or to propAMMs. Any contract that settles value against an outside price inherits that price's worst moment unless it decides, in code, what a believable price looks like. It's the same unbounded acceptance that cost 42DAO $912K in July, when a price was taken with no limit on how far it could move.

The Attack in One Transaction

The traced exploit transaction was signed by nika6v...BMzo and landed in slot 409430505 at 12:44:04 UTC. It made both swaps inside one custom program instruction. The first sent 4,096 USDC into GoonFi V2 and received 1,539.265798532 WSOL at the broken quote. The second sold that same WSOL on BisonFi for 127,286.030966 USDC. Solana transactions are atomic, so the searcher never held unhedged SOL for even a moment. Either both legs filled at a profit or neither happened.

That transaction accounts for roughly half of the reported total. MixBytes describes searchers, plural, buying below market while the bad quote was live, which fits a drain that ran across more than one fill before the program was halted.

What Came After

The team halted the program, as Cetipo reported within about an hour of the drain. As of November 10, 2026, GoonFi hadn't published a post-mortem for the March 28 incident, and no recovery of funds had been announced.

Months later, OtterSec looked at GoonFi V2 from a different angle. In an October 15, 2026 write-up, the firm said it had decompiled the program into Rust that rebuilds to the exact on-chain binary, and that doing so let it find a separate critical vulnerability, an accounting flaw tied to token donations into the program's vaults, that put $6.1M at risk. OtterSec says it disclosed that issue to the team privately. It's a different bug from the one behind the March drain, and nothing in OtterSec's write-up ties the two together.

How It Slipped Through

A pricing function tested against realistic market data will pass every test it's given. Quotes move a few basis points, fills land where they should, and the suite stays green. The failure here lives entirely in inputs nobody expects to see: a 30x drop inside one second, then a zero. Those are the cases that only show up when someone deliberately asks what the program does with a price that can't be right. Reviews and test suites cover the behavior they're scoped to cover, and an upstream feed going haywire is easy to file under someone else's problem.

How Olympix Would Have Caught the Unchecked Quote

Olympix reads a program as states, transitions and entry points, and takes in its context to infer the invariants it depends on. For GoonFi V2, the central state is the quote the swap path prices from, and the transition that spends it is the swap. Olympix maps the paths from every entry point to that swap, then narrows them from all paths to the feasible ones, and from there to the ones that touch an invariant.

The invariant here is short. A swap must never settle at a price outside what the market could plausibly be, and a quote that moves more than a bounded amount since the last one, or reads at or near zero, must stop trading instead of filling. Stated that way, the gap is visible. No branch on the swap path compared a new quote with the last one, and no branch rejected a zero.

Had the team run Olympix during development, the engine would have searched for an input sequence that breaks that rule, and the shortest one is almost exactly what happened on March 28: a feed update that drops the ask by 30 times, followed by a swap that buys at it. Olympix would have returned that sequence as a counterexample, with the state changes and the minimal conditions that trigger it, at the merge where the swap path was written. Because GoonFi V2 is a Rust program on Solana, the replay would take the form of a reproducible input sequence for the program rather than an EVM test, and the guard it points to is the same either way.

That counterexample would have pointed straight at the fix: a bound on per-update price movement, a floor tied to recent prices and a hard stop on zero. Each is a few lines of code, and each would have run at every merge and before release.

Decide What a Believable Price Looks Like

GoonFi's market didn't need a perfect feed to survive March 28. It needed a program that refused to trade when the feed stopped describing the real world. For any team settling swaps, loans or liquidations against an outside price, the place to start is the swap path itself and the question of what it does with the worst value that feed could ever send. To see how Olympix maps your pricing paths and hands back a concrete counterexample for every one that breaks, book a technical walkthrough.