Exploit Summary

On July 6, 2026, Summer Finance (Summer.fi) lost approximately $6 million to a flash loan exploit targeting its Lazy Summer Protocol vaults. The attack manipulated the protocol's internal accounting logic, specifically within the Fleet Commander contract, to artificially inflate the value of the attacker's shares before redemption [Source: https://x.com/CertiKAlert/status/2074005902362132625].

Exploit Summary

The attack was an atomic, single-transaction exploit that leveraged a massive flash loan to distort the "price per share" of the protocol's vaults.

Technical Mechanism

The exploit followed a "donation-based" accounting manipulation pattern:

1. Flash Loan: The attacker borrowed $65.4 million in USDC from the Morpho protocol [Source: https://x.com/CertiKAlert/status/2074005902362132625].
2. Liquidity Injection: The attacker deposited approximately $64.8 million into the Silo: Varlamore USDC Growth vault.
3. Accounting Distortion: The attacker called the withdrawFromArks function and "donated" assets directly to the Ark contract (the strategy module). This donation artificially inflated the value returned by the Fleet Commander’s totalAssets() function [Source: https://x.com/blockaid_/status/2074004564060045459].
4. Redemption: Because the protocol now perceived the vault to be worth significantly more than its actual deposits, the attacker’s shares were valued higher. They redeemed these shares for $70.9 million, resulting in a $6 million profit after repaying the flash loan [Source: https://x.com/blockaid_/status/2074004564060045459].

Root Cause

The primary vulnerability was a share accounting flaw in the Fleet Commander contract. The totalAssets() function trusted the reported balances from the Ark strategy modules without accounting for direct, non-standard transfers (donations) [Source: https://x.com/blockaid_/status/2074004564060045459]. By failing to implement "virtual liquidity" or slippage protections against rapid valuation swings within a single block, the protocol allowed the attacker to manipulate the price per share at zero cost beyond the flash loan fee.

Protocol Response

Following the exploit, Summer Finance confirmed the breach and protocol guardians paused all Lazy Summer Protocol vaults to prevent further losses [Source: https://x.com/summerfinance_/status/2074051277332373942]. The stolen funds were reportedly converted into DAI and moved to an attacker-controlled wallet.