4 entries
Security
Incident post-mortems and vulnerability analysis — what broke, how the attack actually worked, and what the code got wrong.
- Incident protocol-wide · 1,656,942.281791 nominal stablecoin units · ongoing· 8 min read
Allbridge Core Solana drain: same-pool account aliasing inflated vUSD state
A forensic analysis of the July 2026 Allbridge Core Solana drain: duplicate source and destination pool accounts were accepted by swap, repeated same-token calls compounded internal vUSD state, and approximately 1.657 million nominal stablecoin units left the USDC and USDT vaults.
solanabridgestablecoinflash-loanpost-mortem - Incident protocol-wide · 773,092.64 USDCupdated · 13 min read
Hinkal shielded-pool drain: phantom notes from an unsound ZK proof
A forensic writeup of the Hinkal USDC shielded-pool drain: five attacker addresses deposited 27,900 USDC, withdrew 800,992.64 USDC, and emptied the pool through proofs that appeared valid but failed to conserve hidden note value.
zkprivacypost-mortemincident - Incident cross-protocol · ≈$6.0M (6,016,755 DAI); +$6.95M pre-positioned SiloVault share lever· 8 min read
Inflating a meta-vault's NAV with a share donation: the Summer.fi FleetCommander drain
An attacker drained ≈$6.0M from Summer.fi's Lazy Summer FleetCommander (LVUSDC) USDC vault in a single flash-loan-funded transaction. The lever: donate illiquid, pre-positioned SiloVault shares into an ark so the FleetCommander books them at full NAV, then round-trip deposit → donate → redeem in one call. A walkthrough of the nested-ERC-4626 accounting flaw and the prepared share funding leg traced back to FixedFloat.
vaulterc-4626nav-manipulationflashloanpost-mortem - Incident single-market · ≈4 LBTC (~4 BTC)updated · 14 min read
Inflating liquidityIndex with flashloan premiums: a ZeroLend post-mortem
A low-liquidity ZeroLend market backed by a post-maturity Pendle PT (PT Lombard LBTC 29MAY2025) was drained of ~4 LBTC. The attacker pumped liquidityIndex via flashloan premiums, accumulated ~10.9955 PT-LBTC via rounding-window arbitrage, then borrowed real LBTC against the drained collateral. A walkthrough of the on-chain facts and the accounting bugs that made it work.
lendingflashloanpost-mortem