Lazy Summer Protocol Exploit Results in $6.04M Loss
The Lazy Summer Protocol experienced a significant exploit due to a flaw in NAV/share price calculation. An attacker manipulated the system using flash loans, leading to a loss of approximately $6.04 million.
Our full investigation: Summer.fi exploit: 6 million DAI became 3,294 ETH in Tornado Cash — through the attacker’s own router, over 16 days
The exploit occurred in the USDC vaults of Lazy Summer Protocol, which is part of Summer.fi. The attacker took advantage of a flaw in the net asset value calculation, inflating the vault's NAV by about 9.5%.
By utilizing flash loans and pre-accumulated overvalued Silo tokens, the attacker was able to redeem at the inflated price. This manipulation resulted in the extraction of approximately $6.04 million from other depositors.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0x7BF716167B48CF527725722C6d79494b45B3BDCa | ETH | mentioned in coverage | Check live |
| 0x0514F827C129C16418a0933E03C99A6AF982FC61 | ETH | mentioned in coverage | Check live |
| 0x46E09c4D4d20C0474598b4d2fFDd08bdf416eBa7 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.