Incident Overview
Published 7/6/2026, 7:49:38 PM
On July 6, 2026, the DeFi yield-optimization protocol Summer Finance (formerly Oasis.app) suffered a $6 million exploit targeting its "Lazy Summer" AI-keeper system [Source: https://uphold.com/newsletter-archive/akuE9hEAADEA2EnM]. The attack utilized a sophisticated flash loan to manipulate the protocol's internal share accounting, allowing the attacker to withdraw significantly more assets than they had deposited [Source: https://coinmarketcap.com/alexandria/article/summer-finance-6m-flash-loan-vault-exploit].
Incident Overview
The exploit occurred at approximately 06:40 UTC on July 6, 2026. The primary vector was a flash loan-assisted price manipulation of vault share accounting within the Lazy Summer Protocol, which uses "AI keepers" to rebalance user deposits across lending platforms to maximize yield [Source: https://uphold.com/newsletter-archive/akuE9hEAADEA2EnM].
| Metric | Details |
|---|---|
| Total Loss | ~$6 million USD |
| Attacker Address | 0x6b175474e89094c44da98b954eedeac495271d0f |
| Flash Loan Amount | $65.4 million |
| Net Profit | ~$5.5M – $6M (converted to DAI) |
Technical Exploit Mechanism
The exploit targeted a share accounting vulnerability in the FleetCommander smart contract. The attacker manipulated the totalAssets() function, which the protocol used to determine the value of its holdings [Source: https://coinmarketcap.com/alexandria/article/summer-finance-6m-flash-loan-vault-exploit].
- Flash Loan & Deposit: The attacker took a $65.4 million flash loan and deposited $64.8 million into the protocol's vaults.
- Accounting Manipulation: The attacker targeted the Silo: Varlamore USDC Growth vault. By "donating" vault tokens to the Ark contract (the bridge between the vault and external lending protocols) within a single transaction block, they skewed the share price calculation.
- Inflated Redemption: The
totalAssets()calculation failed to account for these external token donations correctly. This led the protocol to believe the attacker's shares were worth significantly more than their actual deposit. - Withdrawal: The attacker redeemed their shares for $70.9 million, repaid the flash loan, and exited with the profit [Source: https://coinmarketcap.com/alexandria/article/summer-finance-6m-flash-loan-vault-exploit].
Root Cause and Response
The root cause was the protocol's reliance on a totalAssets() calculation that was susceptible to manipulation via external token donations and flash loans. The system failed to validate the relationship between the vault's underlying assets and the tokens held in the Ark contract during a single transaction.
Security firms including Blockaid, Cyvers, and CertiK flagged the exploit and provided technical breakdowns of the contract interactions [Source: https://coinmarketcap.com/alexandria/article/summer-finance-6m-flash-loan-vault-exploit]. While third-party analysis has identified these mechanics, a final official post-mortem from Summer Finance is still pending as of the current research data.