On July 6, the DeFi protocol Summer.fi, operating on the Lazy Summer Protocol, fell victim to a sophisticated hacker attack. The project team promptly confirmed the incident, suspending all Vaults to contain the damage. Currently, developers are refraining from disclosing the exact amount and technical details, but on-chain analytics data is already shedding light on the attack mechanism.
According to Cyvers' analysis, the attacker exploited a vulnerability in the asset share accounting mechanism, allowing them to manipulate prices. After a successful exploit, the hacker converted the stolen $6 million into DAI stablecoins and withdrew them to their own wallet. A key element of the attack was a $65.4 million flash loan, which temporarily inflated the liquidity volume in the protocol, enabling the attacker to initiate withdrawals totaling approximately $70.9 million. The hacker's net profit amounted to about $6 million.
Root of the Problem: Distortion of totalAssets()
CertiK specialists detailed the attack vector. The issue lies in the FleetCommander smart contracts, which manage asset vaults. The attacker manipulated the totalAssets() indicator — a key parameter determining the total value of deposits. An additional role was played by the Ark contract, which connects Summer.fi with external lending protocols. The hacker pre-accumulated certain assets, particularly in the Silo: Varlamore USDC Growth vault, and then, using a donation in the Ark contract, distorted the totalAssets() calculation, allowing them to withdraw significantly more funds than were deposited.
This incident is another reminder that even established DeFi protocols are not immune to attacks targeting internal accounting mechanisms. Damage from hacks in June decreased to $75.9 million (40 incidents), and Humanity Protocol lost $31 million. However, the second quarter of 2026 set an anti-record for the number of exploits — 83 cases. In my opinion, vulnerabilities in share accounting systems and flash loan manipulations are becoming a new trend. Protocols need not only to test smart contracts but also to implement dynamic monitoring systems capable of detecting anomalies in totalAssets() calculations in real time. Otherwise, we risk seeing similar scenarios repeated in the coming months.