Analysis: Summer.fi $6 million Hack Linked to Flash Loan Exploit

BlockBeats News, July 6th, the DeFi yield optimization protocol Summer Finance (Summer.fi) reportedly suffered a security attack, with on-chain analytics firms estimating a loss of around $6 million.

Blockchain security company Blockaid was the first to discover this security incident. Cyvers stated that the attacker allegedly exploited a vulnerability in the protocol's Share accounting mechanism, conducted an attack through price manipulation, then exchanged the stolen assets of approximately $6 million into the DAI stablecoin and transferred them to the attacker's controlled address.

CertiK further analyzed that the attacker utilized approximately $65.4 million flash loan, manipulated the Lazy Summer Protocol's treasury asset valuation logic under Summer.fi, and ultimately, after depositing around $64.8 million, successfully redeemed assets of about $70.9 million, resulting in a profit of around $6 million.

It is reported that the vulnerability involves the Fleet Commander contract, which manages the protocol's treasury assets, regarding the asset calculation logic for totalAssets(). The attacker accumulated a specific treasury position in advance and influenced asset calculation by donating assets to the Ark contract, thus completing the arbitrage.

As of the time of reporting, Summer.fi has not yet officially confirmed this attack incident through official channels, and the root cause of the vulnerability is still under investigation.