On July 6, the DeFi protocol Summer.fi fell victim to a hacker attack, resulting in the attacker withdrawing approximately $6 million. The project team confirmed the incident and announced the start of an investigation, temporarily suspending the operation of all Vaults in the Lazy Summer Protocol ecosystem.
Technical Details of the Attack
According to data from analytical platforms, the attacker used a complex strategy based on a vulnerability in the asset share accounting mechanism. Specifically, the attacker employed a flash loan of $65.4 million to temporarily inflate the protocol's liquidity. This allowed them to initiate a withdrawal of $70.9 million, with the hacker's net profit amounting to $6 million.
CertiK experts determined that the manipulation affected the totalAssets() accounting system in the FleetCommander smart contracts, which manage the distribution of deposits among lending platforms. An additional factor was the Ark contract, which connects the protocol to external lending services. The hacker had previously accumulated assets in a specific vault (Silo: Varlamore USDC Growth) and then donated them to Ark, distorting the calculations.
After successfully withdrawing the funds, the attacker exchanged the stolen assets for DAI stablecoins and transferred them to their own address. According to Cyvers, the initial transaction was funded through the FixedFloat service on the Base network.
Context and Conclusions
The incident with Summer.fi occurred against the backdrop of an overall decline in losses from crypto hacks in June — $75.9 million across 40 recorded attacks. The largest of these was the attack on Humanity Protocol, which cost the project $31 million. However, the second quarter set an anti-record for the number of exploits — 83 cases, the highest figure in the history of observations.
This case once again highlights the vulnerability of DeFi protocols built on complex asset redistribution systems. Using flash loans to manipulate totalAssets() indicators is a classic attack vector that requires developers to conduct more thorough audits of mathematical share accounting models. The market needs to implement more reliable mechanisms for real-time verification of pool states; otherwise, such incidents will become the norm.