Summer Finance Loses $6 Million in Flash Loan Exploit

DeFi yield-optimization protocol Summer Finance, also known as Summer.fi, was exploited for $6 million on Monday, according to multiple blockchain security firms tracking the incident. Security platform Blockaid flag the breach early Monday morning, with additional details following from other analysts.

How the Attack Unfolded

According to security firm Cyvers, the attacker exploited a vulnerability in how the protocol accounted for user shares, using price manipulation before converting the stolen funds into DAI stablecoin and moving them to a separate wallet.

Security firm CertiK offered a more detailed breakdown, saying the attacker took out a $65.4 million flash loan to secure a $70.9 million redemption. The exploit centered on how Summer.fi’s Lazy Summer Protocol calculated total assets across its vaults. The protocol relies on automated systems, described as AI keepers, that shift user deposits across various lending platforms to optimize yield.

CertiK explained that the attacker deposited close to $64.8 million and was able to withdraw $70.9 million by manipulating asset calculations tied to FleetCommander, the smart contract that oversees the vaults. The attacker reportedly built up a position in one specific vault, tied to Silo’s Varlamore USDC Growth strategy, and donated those funds to a connecting contract known as the Ark shortly before the exploit.

Protocol Yet to Confirm Breach

Summer.fi has not officially acknowledged the exploit, and the precise root cause has not been confirmed. The incident adds to a growing list of flash loan attacks targeting DeFi protocols that rely on automated vault accounting systems.