On July 6, the DeFi protocol Summer.fi fell victim to a targeted hacker attack. The project team confirmed the incident, announcing a temporary suspension of all Vaults within the Lazy Summer Protocol. Developers have not yet disclosed the exact amount of damage or technical details, but data from leading analytical platforms is already shedding light on the exploit mechanism.
According to information from Cyvers, the attacker exploited a vulnerability in the protocol's asset share accounting mechanism. By manipulating prices, the hacker managed to withdraw funds totaling approximately $6 million. The stolen assets were converted into DAI stablecoins and transferred to the attacker's personal address. The funding source of the attack was traced to the FixedFloat crypto exchange on the Base network.
Analysts at CertiK provided a more detailed picture. The attacker used a flash loan of $65.4 million to temporarily inflate the protocol's liquidity. This allowed them to initiate a withdrawal of approximately $70.9 million. The hacker's net profit was about $6 million — the difference between the deposit and withdrawal.
The key vulnerability lies in the FleetCommander smart contracts, which manage pools and automatically redistribute user deposits among lending platforms. The attacker distorted the totalAssets() indicator in these contracts using pre-accumulated funds in the Silo: Varlamore USDC Growth pool. An additional role was played by the Ark contract, which connects the protocol to external lending services. It was through this contract that the hacker carried out the manipulation, sacrificing part of the assets to alter the accounting.
This incident is another reminder that even complex liquidity management systems like Lazy Summer are vulnerable to attacks based on manipulation of internal metrics. Against the backdrop of June statistics, where damage from hacks decreased to $75.9 million, and the second quarter set an anti-record for the number of exploits (83), such incidents highlight the need for more thorough auditing of asset accounting mechanisms in DeFi.
My professional opinion: This hack demonstrates a classic error in DeFi architecture — trust in internal oracles and mathematical models without sufficient protection against share manipulation. Protocols using complex liquidity aggregation schemes should implement mechanisms to verify the integrity of totalAssets() at every stage of interaction with external contracts. Otherwise, such attacks will recur.