Exploit Summary
Published 7/6/2026, 9:47:14 PM
On July 6, 2026, Summer Finance (Summer.fi) lost approximately $6 million to a flash loan exploit targeting its Lazy Summer Protocol vaults. The attack manipulated the protocol's internal accounting logic, specifically within the Fleet Commander contract, to artificially inflate the value of the attacker's shares before redemption [Source: https://x.com/CertiKAlert/status/2074005902362132625].
Exploit Summary
The attack was an atomic, single-transaction exploit that leveraged a massive flash loan to distort the "price per share" of the protocol's vaults.
| Metric | Value |
|---|---|
| Date of Exploit | July 6, 2026 |
| Total Loss | ~$6,000,000 (converted to DAI) |
| Flash Loan Size | $65,400,000 (USDC) |
| Target Contract | Fleet Commander (totalAssets() function) |
| Attacker Address | 0x6b175474e89094c44da98b954eedeac495271d0f [Note: not independently confirmed] |
Technical Mechanism
The exploit followed a "donation-based" accounting manipulation pattern:
- Flash Loan: The attacker borrowed $65.4 million in USDC from the Morpho protocol [Source: https://x.com/CertiKAlert/status/2074005902362132625].
- Liquidity Injection: The attacker deposited approximately $64.8 million into the Silo: Varlamore USDC Growth vault.
- Accounting Distortion: The attacker called the
withdrawFromArksfunction and "donated" assets directly to the Ark contract (the strategy module). This donation artificially inflated the value returned by the Fleet Commander’stotalAssets()function [Source: https://x.com/blockaid_/status/2074004564060045459]. - Redemption: Because the protocol now perceived the vault to be worth significantly more than its actual deposits, the attacker’s shares were valued higher. They redeemed these shares for $70.9 million, resulting in a $6 million profit after repaying the flash loan [Source: https://x.com/blockaid_/status/2074004564060045459].
Root Cause
The primary vulnerability was a share accounting flaw in the Fleet Commander contract. The totalAssets() function trusted the reported balances from the Ark strategy modules without accounting for direct, non-standard transfers (donations) [Source: https://x.com/blockaid_/status/2074004564060045459]. By failing to implement "virtual liquidity" or slippage protections against rapid valuation swings within a single block, the protocol allowed the attacker to manipulate the price per share at zero cost beyond the flash loan fee.
Protocol Response
Following the exploit, Summer Finance confirmed the breach and protocol guardians paused all Lazy Summer Protocol vaults to prevent further losses [Source: https://x.com/summerfinance_/status/2074051277332373942]. The stolen funds were reportedly converted into DAI and moved to an attacker-controlled wallet.