Loopscale RateX-token-pricing exploit — Solana — 2025-04-26

Summary

Loopscale is a Solana-native lending protocol that supports a range of collateral types, including yield-bearing positions derived from the RateX yield-token system. RateX is a Solana-native primitive that splits a yield-bearing asset into principal-token (PT) and yield-token (YT) components, with the YT entitling the holder to the future yield stream of the underlying. Pricing PT and YT positions correctly requires the consuming protocol to model the underlying's yield-accrual schedule, the maturity of the position, and the protocol-specific assumptions about how the PT / YT split resolves at maturity.

On April 26, 2025, an attacker exploited a flaw in Loopscale's pricing logic for RateX-derived collateral. Per the public forensic write-ups (SlowMist, OtterSec, and Loopscale's own post-incident disclosure), the protocol's RateX-collateral pricing computation could be driven to attacker-favourable values via a sequence of on-chain interactions involving the RateX primitive's state, allowing the attacker to deposit RateX-derived collateral that the protocol valued substantially above its true on-chain redemption value, and then borrow against that inflated valuation to extract real assets from Loopscale's reserves. The execution was funded via flash loans and completed within a tight on-chain window.

Loopscale detected the anomaly, paused the affected markets, and engaged in on-chain negotiation with the attacker. The negotiation produced a partial recovery — approximately $2.9M of the ~$5.7M extracted — with the attacker retaining a non-trivial share. The residual loss was absorbed by Loopscale operationally, and the protocol re-launched its RateX-collateral support under a corrected pricing path subsequently.

For OAK's purposes the structurally important feature is the yield-token-pricing-specific nature of the failure. Loopscale was not generically broken; its standard collateral pricing (SOL, stablecoins) was correct. The failure was confined to the RateX-yield-token-pricing path, which involved protocol-specific assumptions that the integration did not fully verify. This is the canonical 2025 worked example for the yield-token-pricing-integration threat surface within Solana DeFi.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Loopscale deploys lending markets on Solana with support for RateX-derived yield-token collateral; pricing logic for RateX collateral encodes protocol-specific assumptions about the yield-token state machine	T9.001 surface (latent)
Pre-event	Latent flaw: the RateX-pricing logic does not adequately verify the assumptions it makes about the yield-token's redemption-state, allowing attacker-favourable price readings under specific input combinations	(latent integration flaw)
2025-04-26	First attack tx on Solana: attacker funds a flash-loan-backed sequence, drives the RateX-pricing path to inflated values, deposits the inflated collateral against Loopscale's lending markets, borrows against it, and extracts real reserves	T9.001 + T9.002 extraction
2025-04-26	Cumulative on-Loopscale outflow reaches ~$5.7M	T9.001 + T9.002 amplified
2025-04-26	Loopscale operations team detects anomalous lending-market state; pauses affected markets at the protocol layer	(operator response)
2025-04-26	Attacker begins routing extracted proceeds through Solana-native swap and bridging infrastructure	(laundering pattern)
2025-04-26 onward	Loopscale publishes on-chain negotiation offer; attacker engages with the offer	(recovery negotiation)
2025-04-26 → days following	Negotiated settlement: ~$2.9M returned by the attacker; residual retained by attacker; Loopscale absorbs the residual loss operationally	Partial recovery via negotiation
2025-04 onward	Loopscale publishes post-incident write-up; corrected RateX-pricing path deployed; lending markets re-launched with the corrected logic	(transparency, re-launch)

What defenders observed

• The failure was confined to the yield-token-pricing path. Loopscale's pricing of generic collateral was unaffected; the attacker's leverage was specifically in the RateX-derived collateral type. This is operationally important for defenders: lending protocols on Solana (and on EVM chains, where Pendle plays a similar yield-token role) should not assume that a single audit pass over their pricing infrastructure covers all collateral types — yield-token integrations carry protocol-specific assumptions about the underlying primitive's state machine, and each integration is its own audit surface. The Loopscale case is the strongest 2025 evidence of this for Solana-native yield-token pricing.
• Solana-specific execution speed amplified the extraction window. Solana's high transaction throughput and short block times allowed the attacker to compress the extraction sequence into a tight window. Defender response infrastructure on Solana must contend with a substantially shorter detect-pause-isolate window than on EVM-mainnet — the time-to-detection requirement is stricter, and the time-to-pause must be similarly compressed. Loopscale's response landed within a window that allowed for partial recovery; protocols with slower operational response would face a structurally worse outcome on Solana for the same exploit shape.
• The negotiation outcome was less generous than the parallel KiloEx and ZKsync cases. The Loopscale recovery (~50% of the extracted balance) is materially less complete than the KiloEx (~100%) and ZKsync (~100%) outcomes from the same April 2025 window. The conditions were less favourable: the assets were Solana-native and partially fungible into deeper-liquidity venues than the ZKsync ZK-token case; the laundering surface for the residual was wider; and the attacker's expected-value calculation supported retaining a larger share. Defenders running bounty negotiations should expect outcomes to vary substantially based on the laundering surface for the extracted asset; Loopscale's partial-recovery shape is the realistic-floor reference for cases with wider laundering surfaces.
• The attacker began routing proceeds before the negotiation concluded. Per the public forensic write-ups, a portion of the extracted balance was routed through Solana-native swap and bridging venues during the negotiation window. This is a real defender-side dynamic: the negotiation surface narrows as routing proceeds, because each successful hop reduces the attacker's perceived recovery-cost differential between accepting an offer and continuing to launder. Defenders running incident-response playbooks should treat the negotiation window as time-bounded — every hour of routing activity reduces the attacker's incentive to accept.
• Yield-token integration audits should explicitly cover state-machine assumptions, not just price-reading logic. The Loopscale flaw was not a missing access-control check (T9.004) or a generic pricing-feed manipulation (T9.001 narrow); it was a protocol-specific assumption about the RateX yield-token primitive's redemption mechanics that the integration consumed without adequate verification. Defender audit checklists for yield-token integrations should explicitly call out: (a) the underlying primitive's state-machine assumptions, (b) the consuming protocol's verification of those assumptions, (c) the failure modes when the assumptions do not hold. The Loopscale case is the strongest 2025 evidence that audits focused only on price-reading correctness — without checking the underlying state-machine assumptions — leave a meaningful residual surface.

What this example tells contributors writing future Technique pages

• T9.001 in the broad construction covers yield-token-pricing-integration failures, but the sub-pattern deserves explicit recognition. The OAK-T9.001 page covers oracle / pricing-source manipulation; the Loopscale case is the canonical 2025 worked example for the yield-token-pricing-integration sub-pattern, where the failure is in protocol-specific math about a structured yield instrument rather than in standard signed-price consumption. Contributors writing T9.001 examples should preserve this sub-pattern explicitly — it is a recurring class within the 2024–2025 corpus (Pendle-related EVM cases, RateX-related Solana cases, structured-product integrations more generally).
• Solana-native worked examples deserve specific defender-handbook framing for response-time constraints. The Cetus case at examples/2025-05-cetus.md covers the Sui validator-coordinated freeze as a non-EVM L1 recovery primitive; the Loopscale case covers the Solana high-throughput-amplifies-extraction-window dynamic. Together they establish that non-EVM L1 worked examples in OAK should treat L1-specific operational properties as first-class — Solana's response-time constraint is a real defender consideration, and the corpus should reflect that.
• Partial-recovery outcomes are a real category, not a degenerate case of full recovery. The Loopscale case sits between KiloEx (~100% via bounty), ZKsync (~100% via bounty), and the long tail of zero-recovery DeFi exploits. Contributors writing recovery-rate documentation should treat partial-recovery-via-negotiation as its own outcome class, with the Loopscale case as the 2025 reference. The conditional factors — wider laundering surface, faster initial-routing speed, less favourable economics for full attacker acceptance — should be documented explicitly.
• pseudonymous is the correct attribution status, with the negotiation-acceptance signal preserved. As with KiloEx and ZKsync, the attacker's engagement with the negotiation surface produced no off-chain identification. Contributors should not over-claim attribution simply because the actor was partially responsive.
• The April 2025 cluster of three negotiation-recoveries (KiloEx, ZKsync, Loopscale) is a structural feature of the corpus. Contributors writing OAK-G ungrouped-actor or DeFi-incident retrospectives should preserve the temporal density: three separate pseudonymous DeFi exploits within a single calendar month, all of which produced some on-chain bounty-style negotiation, with substantially different recovery rates (~100% / ~100% / ~50%). The pattern suggests that the availability of the bounty-negotiation surface is now well-recognised in pseudonymous attacker behaviour for 2025 DeFi exploits; the outcome of the surface still depends on case-specific economics.

Public references

• [loopscalepostmortem2025] — Loopscale Protocol's official post-incident disclosure of the RateX-collateral pricing flaw, the affected markets, and the negotiated partial-recovery outcome.
• [ottersecloopscale2025] — OtterSec post-incident technical analysis of the RateX-pricing failure, including the state-machine-assumption framing and the integration-audit lessons.
• [slowmistloopscale2025] — SlowMist incident analysis covering the funding cluster, the extraction sequence, and the post-extraction Solana-native routing.
• [chainalysis2025rug] for category-level context on 2025 DeFi-incident loss totals (used as the broad-context citation).

Discussion

Loopscale is OAK's canonical 2025 case for the yield-token-pricing-integration failure on Solana. The 2024–2025 corpus contains a small but growing cluster of incidents where the failure surface is specifically the consuming protocol's pricing of a structured yield-instrument collateral type — the Pendle-related cases on EVM chains, the RateX-related Loopscale case on Solana, and a handful of other structured-product integrations across chains. Loopscale is the case that establishes this sub-pattern as a first-class defender concern within OAK's worked-example layer.

The technical teaching point is that yield-token pricing is genuinely harder than standard collateral pricing. A standard collateral price is a single signed feed (oracle-vendor-provided). A yield-token price involves the underlying instrument's yield-accrual schedule, its position maturity, the protocol-specific PT / YT split mechanics, and the redemption-state of the position at the time of valuation. Each of these introduces protocol-specific assumptions that the consuming integration must verify, not just consume. The Loopscale flaw was a verification gap on one of those assumptions — the integration trusted that the RateX-derived value would correspond to a real on-chain redemption value, when under the attacker's chosen input combination the two diverged. This is structurally different from the KiloEx integration-side oracle-manipulation case, where the failure was in authorisation of price-update triggering; Loopscale's failure was in verification of the math assumptions in the price-computation path itself.

The negotiation outcome — partial rather than full recovery — is the second-order observation that distinguishes this case from its April 2025 siblings. The Loopscale 50%-recovery is the realistic-floor reference for bounty-mediated recoveries within the year, against the KiloEx and ZKsync ~100% ceilings. The conditional factors that pushed Loopscale toward the floor — wider laundering surface for Solana-native assets, faster initial-routing speed before negotiation began, less favourable attacker economics for full acceptance — are documentable and useful for defenders running their own incident-response playbooks. Contributors writing recovery-rate documentation should treat the April 2025 trio as the bracketing case-set: KiloEx and ZKsync at the ceiling, Loopscale at the floor, with the surrounding cases distributing across the range.

For OAK's broader credibility, including Loopscale in v0.1 closes one gap: it adds a Solana-native DeFi-exploit worked example with a yield-token-pricing-integration-failure sub-pattern, complementing the Cetus case at examples/2025-05-cetus.md (Sui-native CLMM tick-math overflow) as the second non-EVM L1 worked example for 2025 H1. Together the two strengthen the corpus's coverage of non-EVM DeFi failure modes and their L1-specific operational properties.