On July 6, the DeFi protocol Summer.fi fell victim to a targeted attack. The project team promptly confirmed the incident and suspended all Vaults within the Lazy Summer Protocol to prevent further damage.
The exact amount of the loss was initially not disclosed, but on-chain analytics shed light on the attack mechanism. According to Cyvers, the attacker exploited a critical vulnerability in the asset share accounting mechanism. By manipulating prices, the hacker was able to distort balances and withdraw funds. The stolen $6 million was then converted into DAI stablecoins and sent to the attacker's personal wallet.
Flash Loan and totalAssets() Manipulation
CertiK experts provided a more detailed picture. The attacker used a $65.4 million flash loan to temporarily inflate the protocol's liquidity. This allowed them to initiate a withdrawal of approximately $70.9 million, with the hacker's net profit amounting to about $6 million.
The key vulnerability was found in the FleetCommander smart contracts, which manage the distribution of user deposits across various lending platforms. The attack affected the totalAssets() function — an indicator of the total asset volume in the vaults. Manipulating this value, combined with the specific workings of the Ark contract (a link to external lending services), allowed the hacker to obtain a disproportionately large share during the withdrawal.
Notably, the attacker had previously accumulated positions in a specific vault (Silo: Varlamore USDC Growth) and used a donation mechanism via Ark to exacerbate the imbalance.
Market Context and Conclusions
This incident occurred against a backdrop of a relative decline in hacker activity in June, when total losses from crypto hacks amounted to $75.9 million across 40 recorded attacks. However, the second quarter of this year set an anti-record for the number of exploits — 83 cases, the highest figure ever observed.
My professional opinion: The Summer.fi hack is a classic example of an attack based on manipulating oracles and internal protocol accounting. Such incidents highlight the critical importance of auditing not only individual smart contracts but also the entire logic of their interaction, especially in complex aggregation protocols where the slightest error in share calculation can lead to multi-million dollar losses. The market urgently needs more advanced methods for simulating attacks before code is deployed to the mainnet.