How an Unfinished Offboarding Cost Summer.fi $6 Million

On July 6, 2026, an attacker converted a months-old administrative loose end into a $6.04 million loss for the Lazy Summer Protocol, draining two of its vaults in a single atomic transaction. Summer.fi later described the root cause as an offboarding process that had been started but never finished: eight months earlier, someone at Summer.fi had zeroed the deposit cap on a Silo-based Ark, and the cleanup stopped at that step.

Notably, the attack required none of DeFi's usual culprits — no reentrancy bug, no oracle exploit, and no compromised admin key. Instead, a Silo market that had been marked for removal back in October remained inside the protocol's net-asset-value calculation, still priced as though nothing had changed even though it was never revalued after November's Stream Finance collapse. The attacker's approach was, in essence, to donate a token into an Ark that could not actually be withdrawn, watch the reported share price climb as a result, and then redeem shares against the vault's genuinely liquid holdings. Roughly three months of preparatory wallet funding preceded a transaction that took only minutes to execute.

Once underway, the protocol's Guardian Module faced its first real test since April. It managed to freeze what it had authority over, but it turned out to hold no guardian rights at all on one supported chain. In its own accounting, Summer.fi characterized the episode as a gap in offboarding procedure rather than a defect in the code — the contracts, in other words, executed exactly as they were written.

01Detection and disclosure

Blockaid's monitoring system flagged the attack on July 6 while the exploit transaction was still executing, posting that its "exploit detection system has identified an ongoing exploit on Summer Finance... ~$6M drained so far." A second post arrived roughly a minute later containing the exploit transaction hash, the attacker's address, the exploit contract, and the full list of affected Lazy Summer contracts — enough for any other security firm to begin its own investigation before Summer.fi had issued any public statement.

Independent researcher Vladimir S. amplified the alert within minutes. CertiK's detection system also fired shortly afterward, summarizing the attack as a $65.4 million flash loan deployed for liquidity manipulation that netted the attacker roughly $6 million. Cyvers reported that the attacker's wallet had first been funded via FixedFloat on Base prior to the Ethereum transaction. QuillAudits then published an analysis identifying the flaw as a same-transaction share-pricing and sequencing problem rather than oracle manipulation — a distinction it drew before most other commentary had addressed it.

Phylax Systems founder Odysseus offered a more detailed technical read, attributing the root cause to same-transaction vault/Ark accounting combined with liquidity manipulation, explicitly ruling out key compromise or admin-role abuse. He also pointed out that while the exploit contract itself was unverified, the Lazy Summer contracts it interacted with were verified and had behaved exactly as coded.

Summer.fi's first public statement came about three hours after the initial alerts: "We are aware of the reported exploit a little earlier today and are investigating the root cause. The protocol guardians are currently pausing all Vaults across the Lazy Summer Protocol." By the time that statement went out, PeckShield had already identified the primary target as LVUSDC, a vault risk-managed by Block Analitica, and had noted that the vault's displayed APY had briefly spiked to approximately 2.08 million percent. PeckShield further identified the vault's largest post-exploit holder as an address reportedly associated with Torben Jorgensen of UDHC, holding close to 8.6 million USDC in a vault that could no longer process normal withdrawals.

Summer.fi's second statement followed roughly eleven hours after the first alert, finally using explicit language: "We identified an active exploit affecting the Lazy Summer Protocol earlier today. As a precaution, Guardians have paused all vaults and set deposit caps to zero across networks. The situation is being actively assessed. Please do not interact with the protocol until further notice." Several independent researchers and security firms had already converged on the same general explanation well before that confirmation arrived.

02How the vault accounting broke down

Lazy Summer vaults calculate their share price by summing totalAssets() across all active Arks and dividing by the number of shares outstanding. In practice, this meant a stale and illiquid position continued to be treated as though it were cash: even after the relevant Ark stopped accepting new deposits, it remained inside the NAV calculation, so any additional amount deposited into it would inflate the vault's paper value without adding any real liquidity.

The origin traces back to governance action from September 2025. Summer.fi's official governance recap for that month confirms an on-chain vote tied to SIP2.24, "Update ARKs from core protocols on mainnet fleets (USDC/WETH/USDT)," which proposed adding two Arks to the LazyVault_LowerRisk_USDC Fleet on mainnet. The proposal was published September 4 and later passed and executed.

The deposit cap on one of those Arks was set to zero on October 30, 2025, a response to November's Stream Finance collapse and the subsequent xUSD depeg — roughly eleven weeks after the Ark had first been onboarded. Zeroing a cap only blocks new deposits; it does not remove the Ark from the active set, and the removeArk function requires the Ark to already hold zero assets — a condition this offboarding never reached.

The timing overlapped with a separate incident: within days of that cap reaching zero, a Balancer V2 exploit triggered a chain reaction that reached Summer.fi's Arbitrum USDC vault. The affected position there was the sUSDx Ark, whose caps Block Analitica zeroed on November 4 before the DAO formally removed it via SIP2.39, a removal executed on November 21 — seventeen days from cap-zeroing to full removal. No equivalent cleanup for the Varlamore Ark appears in the public record; it seems to have stayed active and priced into NAV the entire time.

From the October 30, 2025 cap-zeroing to the July 6, 2026 exploit, roughly eight months elapsed with that stale valuation left untouched — priced near par and never written down for the underlying bad debt.

Summer.fi's post-incident report is explicit on one point: this was not a totalAssets() versus withdrawableTotalAssets() bug. Redemptions drain Arks in ascending order of size, meaning the large, manipulated Ark was queued last and was never the first one redeemed. The underlying issue, in other words, was less a broken function than a dangerous sequence of otherwise-correct steps.

03The two-vault mechanism

The attacker began with a smaller vault as a warm-up. A near-costless deposit-and-withdrawal round trip through the HigherRisk USDC vault moved approximately $398,000 into that vault's buffer, positioning liquid assets to later cover an inflated redemption.

The larger move followed. The attacker took a flash loan of more than $65 million in USDC plus a smaller USDT tranche and deposited roughly $64.8 million into the LowerRisk USDC vault at a genuine share price near 1.0665. The stale Silo Varlamore position was then donated straight into its Ark — no shares were minted in the process — which pushed the vault's reported NAV up by about 9.5 percent and its share price to 1.1678.

Redeeming the inflated position paid out close to $71 million against the $64.8 million that had been deposited. That payout did not come from the donated Ark itself but from the vault's genuinely liquid Morpho, Spark, and Sky positions — meaning it was funded by other depositors' capital. After repaying the flash loan, the attacker swapped the remaining profit into DAI via Curve and ended up with 6,016,754.998 DAI, broken down as roughly $5.64 million extracted from LowerRisk and about $0.40 million from HigherRisk.

None of this required significant capital upfront — the preparatory wallet funding had already taken about three months, while the exploit transaction itself lasted only minutes.

On-chain reference data

• Exploit transaction: 0x0db528c44f23fc7fa4544684a2fab81096450a14aae8bc89f42cd0592d43da12
• Attacker EOA: 0x7BF716167B48CF527725722C6d79494b45B3BDCa
• Exploit contract (unverified): 0x0514F827C129C16418a0933E03C99A6AF982FC61
• Attacker's intermediary wallet (used to route funds into Tornado Cash): 0x46E09c4D4d20C0474598b4d2ffDd08bdf416eBa7
• LazyVault_LowerRisk_USDC (primary vault hit): 0x98C49e13bf99D7CAd8069faa2A370933EC9EcF17
• LazyVault_HigherRisk_USDC (hit first to build the buffer): 0xE9cDA459bED6dcfb8AC61CD8ce08E2D52370cB06
• Flash loan source: Morpho — approximately 65.419 million USDC plus 1 million USDT
• Final payout: 6,016,754.998 DAI, converted from USDC

Part of the stolen proceeds was later moved through an intermediary wallet into Tornado Cash, via repeated 10 ETH and 100 ETH deposits, extending the cash-out trail after the initial exploit. The exploit contract itself has not been verified; everything understood about its internal logic has been inferred from transaction traces and logs against the verified contracts it invoked.

04Guardian response and its limits

The Guardian Module — a 6-of-8 multisig with authority spanning Ethereum, Base, Arbitrum, and Sonic — faced its first live incident during this exploit, having previously been activated only once before, in April, to block a malicious governance proposal.

During the response, it zeroed deposit caps across both DAO-managed vaults, pausing Ethereum first since that was where the exploited vaults resided, followed by Base, Arbitrum, and Sonic as a precaution. It then hit a limitation: on HyperEVM, the pause action reverted because the module did not hold the guardian role on that chain. Deposit caps were already at zero there, so the attack vector was blocked regardless — but the authority gap was genuine, and it surfaced live rather than during a planned test.

The Guardian Module's origin lies in an unrelated earlier episode. Block Analitica's retrospective on the Arbitrum USDC fleet noted that, in response to the USDX event, it had already zeroed the sUSDx Silo Ark's caps on November 4 and was working to reduce exposure more broadly. SIP0.2, which established the Guardian Module, passed roughly three months later, explicitly intended to close that same kind of gap. Yet as of July, it still lacked authority on HyperEVM.

Notably, this exploit did not stem from unaudited code. ChainSecurity's audit of the Summer Earn Protocol, delivered January 14, 2025, directly reviewed FleetCommander and the Ark contracts, including the Ark-removal process. Finding 8.3, titled "Removal of Arks Can Be DOSed," noted that removeArk depends on ark.totalAssets equaling zero, a condition that can fail if residual dust remains after disembarking or if tokens are sent to the Ark before removal. Summer.fi's response at the time was that future Arks should include a mechanism to be fully emptied before removal; the finding itself was rated Informational and marked Acknowledged.

Roughly eighteen months later, an Ark became stuck in essentially that same unresolved category — though not through the precise dust-residue mechanism the audit had described. This was not a dusting attack; the asset in question was simply never fully removed to begin with. The Ark never reached the removal step at all: capped for offboarding, never fully emptied, and therefore still active and still counted in NAV.

Subsequent audits — by Prototech Labs and Sherlock — were scoped to the governance package: staking, vesting, the governor, and the staked token. Neither published scope description mentions FleetCommander or the Arks, so there is no indication that Ark lifecycle risk was reassessed in either review.

05Aftermath

The Foundation multisig swept the donated Silo shares out of the LowerRisk vault within hours, removing the distorted NAV from public view and effectively socializing the loss across the vault. The attacker subsequently moved part of the stolen funds through an intermediary wallet into Tornado Cash; Summer.fi interpreted this as a signal of limited willingness to return the funds voluntarily.

The funding trail Cyvers had flagged within the first hour proved useful: Summer.fi contacted FixedFloat directly, providing the addresses and transactions initially funded through that exchange. Governance now faces a decision over roughly $4 million in illiquid capital still locked in the drained vaults, including whether the exploiter's own shares should be excluded from any reimbursement plan.

An audit had identified this exact vulnerability roughly eighteen months before the exploit, and Summer.fi had acknowledged it at the time — though the available record does not indicate whether it was ever remediated before this incident occurred.

06Summary

In total, $6.04 million moved through a gap that had been visible in the protocol's own records since October 2025. The bulk of the effort behind the exploit was not the flash loan itself but roughly three months of quiet advance wallet funding; the on-chain mechanics — donating an unwithdrawable asset, watching its NAV contribution rise, then redeeming against other depositors' liquidity — were comparatively simple once that groundwork was in place.

ChainSecurity documented the underlying weakness in January 2025, Summer.fi acknowledged that future Arks would need a way to be fully emptied before removal, and the matter did not resurface until the exploit. Later that same year, on a different vault, the DAO demonstrated it could execute exactly that kind of full removal in seventeen days when it chose to prioritize it.

Once the exploit was underway, the protocol's other safeguards largely performed as intended: the Guardian Module paused four of five chains and discovered its authority gap on the fifth, the Foundation multisig swept the donated Silo shares out of the affected vault, and the subsequent post-mortem was technically forthright about what had happened. An acknowledged audit finding is not the same as a resolved one, and a market with its deposit cap set to zero is not the same as one that has actually been removed. ChainSecurity had rated the original finding Informational — the lowest severity tier on its scale.