Worked example · 2026-07

Solido Cash — a stale price feed on the backstop collateral token trips fallback logic that values it far above market, and 809,052 CASH are minted against it — Solido Money (SUPRA) — 2026-07-23

Loss: ~293.7M SUPRA, worth approximately $900,000 at the time of the attack — a small headline figure attached to a mechanism worth more than the number. Roughly 90% of the affected tokens belonged to the Solido Foundation rather than to users. About 84% of the proceeds (~246.9M SUPRA) were traced to centralised-exchange infrastructure, with approximately 220M SUPRA linked to a suspected Gate.io deposit address and a second exchange touchpoint identified in the later wave.
OAK Techniques observed: OAK-T9.001 (Oracle Price Manipulation — primary, confirmed mechanism, recorded in its stale-feed fallback sub-shape. Nobody moved a market. The defect was an oracle misassignment on SOLID, the token used as backstop collateral: a stale price feed triggered fallback logic that valued SOLID far above its actual market price. With collateral artificially inflated, the attacker minted 809,052 CASH — the protocol's stablecoin — far beyond what the real collateral could justify, then sold the CASH for SUPRA. As with examples/2026-07-bonzo-lend-supra-oracle-zeroed-signature-drain.md, the oracle-resilience mitigation family that assumes an attacker moved a real market is largely beside the point here; only a deviation bound helps, and it bounds rather than closes. See techniques/T9.001-oracle-price-manipulation.md). OAK-T9.004 (Access-Control Misconfiguration — cross-referenced for the misassignment itself: the wrong feed was wired to the wrong asset, a configuration defect rather than a logic defect, and it is the reason the fallback path was reachable at all). OAK-T7.002 (CEX Deposit Layering — the ~84% routed to exchange infrastructure).
Attribution: pseudonymous. No named individual or group, and no public link to a tracked OAK actor. The distinctive observable is the two-wave shape: Wave A at 18:21:35 UTC was a single atomic transaction netting 266,778,767.97 SUPRA; Wave B, hours later, manually repeated the same flaw across five wallets. That progression — one automated atomic execution, then a hand-run repeat fanned across fresh addresses — reads as an operator returning to harvest a residue they knew was still open, and is a useful behavioural signature independent of any address attribution. Roughly 220M SUPRA reached a suspected Gate.io deposit address, which is the residual identification path.
Key teaching point: Fallback logic is code that runs precisely when your assumptions have already failed, and it is almost never tested under the conditions that invoke it. Solido's price path had a sensible-sounding design — if the feed goes stale, fall back — and the fallback produced a valuation far above market for the one asset acting as backstop collateral. Two failures stack here and both are cheap to close. First, the misassignment: a feed wired to the wrong asset is a configuration error, invisible to logic review, and catchable by an automated startup assertion that every configured feed's reported price sits within a sane band of an independent reference for the asset it claims to price. Second, the unbounded fallback: a fallback valuation should be conservative by construction — when the protocol does not know what something is worth, the safe direction for collateral is down, never up. A fallback that can value collateral above its live market price has inverted the only rule that matters. The generalisable control is a deviation circuit breaker on the consuming market, which rejects an implausible collateral valuation regardless of which code path produced it, and would have stopped both waves.

Summary

Solido Money operates Solido Cash, a collateral-backed stablecoin (CASH) system. SOLID served as backstop collateral within the protocol.

The protocol's pricing path contained an oracle misassignment affecting SOLID. When the relevant price feed went stale, fallback logic engaged and valued SOLID far above its actual market price, inflating the collateral base the minting function reasoned against.

On 2026-07-23, an attacker exploited this in two waves. Wave A, at 18:21:35 UTC, was a single atomic transaction that netted 266,778,767.97 SUPRA. Wave B followed hours later, manually repeating the same flaw across five wallets. Across both waves the attacker minted 809,052 CASH against the artificially inflated collateral and sold the CASH for SUPRA, removing approximately 293.7M SUPRA — worth roughly $900,000 at the time.

About 90% of the affected tokens belonged to the Solido Foundation, so the loss fell largely on the protocol's own treasury rather than on user deposits.

Solido applied contract-level fixes disabling the exploited minting path, published a detailed incident-response report, traced the proceeds, and requested that exchanges freeze flagged funds and preserve records for law enforcement. Its forensic work placed ~84% of proceeds (~246.9M SUPRA) at centralised-exchange infrastructure, including ~220M SUPRA at a suspected Gate.io deposit address.

Timeline (UTC)

When	Event	OAK ref
(standing)	Oracle misassignment on SOLID, the backstop collateral token; stale-feed fallback logic values SOLID far above market; no deviation bound on the consuming mint path	(standing T9.001 / T9.004 surface)
2026-07-23 18:21:35	Wave A — single atomic transaction mints CASH against inflated SOLID collateral and sells it, netting 266,778,767.97 SUPRA	T9.001 exploitation
2026-07-23, hours later	Wave B — same flaw repeated manually across five wallets	T9.001 repeat
2026-07-23	809,052 CASH minted across both waves; ~~293.7M SUPRA (~~$900,000) extracted; ~90% of affected tokens belonged to the Solido Foundation	(realised loss)
after	~246.9M SUPRA (~84%) traced to centralised-exchange infrastructure; ~220M to a suspected Gate.io deposit address; second exchange touchpoint in the later wave	T7.002
after	Solido applies contract-level fixes disabling the exploited minting path, publishes an incident-response report, and asks exchanges to freeze flagged funds and preserve records	(operator response)

What defenders observed

Pre-event (a feed wired to the wrong asset is invisible to logic review). Misassignment is a configuration defect: the code is correct, the wiring is not. Auditors reading the mint path would find nothing wrong with it. The control is a startup and periodic assertion that each configured feed's price falls within a sane band of an independent reference for the asset it purports to price — a check that costs nothing and catches an entire class that code review structurally cannot (M09, M23).
Pre-event (fallback must be conservative by construction). The load-bearing design error. When a protocol does not know an asset's price, the only safe direction for a collateral valuation is downward. A fallback capable of pricing collateral above its live market has inverted the safety property it exists to preserve. Any fallback path should be reviewed by asking which direction it errs in and whether that direction is safe for the position it feeds.
Pre-event (no deviation bound on the consuming market). This is the same missing control OAK recorded at Bonzo Lend eleven days earlier: a mint path that accepts whatever collateral valuation it is handed. A deviation breaker rejects an implausible valuation regardless of whether it arrived through a broken verifier, a stale fallback, or a manipulated market — one control covering three distinct upstream mechanisms (M09, M04).
At-event (mint volume against a single collateral asset). 809,052 CASH minted against SOLID is a supply event with an obvious denominator. Alerting on CASH issuance against any one collateral type exceeding a share of that collateral's real float would have fired inside Wave A's single transaction.
At-event (Wave B is the diagnostic failure). Wave A was atomic and fast. Wave B ran hours later, by hand, across five wallets — a slow, noisy, entirely detectable repeat against a flaw that was still open. The gap between the two waves was the operator's window to detect and pause, and it went unused. Where an exploit recurs hours later, the finding is not about the original defect but about the absence of a detection-and-halt path.
Response (unusually strong forensics for the loss size). A published incident report, ~84% of proceeds traced to named exchange infrastructure, and specific freeze-and-preserve requests represent better post-incident work than many far larger cases receive — compare examples/2026-07-cascade-cls-vault-prelaunch-locked-deposit-drain.md, where a larger loss produced no public root cause at all.

Public references

[solidoincident2026] — Solido Money, "The Solido Cash Incident — Incident Response" (the operator's own 19-page forensic report: wave structure, tracing, and remediation): https://app.solido.money/reports/solido-cash-incident-july-2026.pdf
[cryptonomistsolido2026] — The Cryptonomist, "Solido Money Hack Drains 293.7M SUPRA Tokens" (2026-07-23 dating, the oracle-misassignment root cause overvaluing collateral, the two waves — one atomic transaction then a manual repeat across five wallets — the 809,052 CASH minted and sold for SUPRA, ~84% / 246.9M SUPRA traced to centralised exchanges with ~220M at a suspected Gate.io deposit address, and the contract-level fix disabling the exploited minting path): https://en.cryptonomist.ch/2026/07/28/solido-money-hack-supra/
[analyticsinsightsolido2026] — Analytics Insight, "Solido Foundation Loses 90% of Stolen SUPRA Tokens in Oracle Attack" (the finding that ~90% of affected tokens belonged to the Solido Foundation; the SOLID backstop-collateral role and the stale-feed fallback that valued it far above market): https://www.analyticsinsight.net/amp/story/news/solido-foundation-loses-90-of-stolen-supra-tokens-in-oracle-attack
[ambcryptosolido2026] — AMBCrypto, "Solido traces 84% of exploit proceeds to exchange infrastructure in forensic report" (independent coverage of the tracing result and the forensic report): https://ambcrypto.com/solido-traces-84-of-exploit-proceeds-to-exchange-infrastructure-in-forensic-report/
[blockonomisolido2026] — Blockonomi, "Solido Money Traces 293M Stolen SUPRA Tokens to Cryptocurrency Exchanges" (the ~$900,000 valuation at time of attack, Wave A timestamp of 18:21:35 UTC and the 266,778,767.97 SUPRA figure): https://blockonomi.com/solido-money-traces-293m-stolen-supra-tokens-to-cryptocurrency-exchanges

Discussion

Solido is the second oracle-path failure in OAK's July 2026 cohort touching SUPRA, after examples/2026-07-bonzo-lend-supra-oracle-zeroed-signature-drain.md on 2026-07-12, and the two should be read as a pair with a caution attached. They are not the same defect and not the same component: Bonzo consumed Supra's on-demand oracle, whose verifier accepted an all-zero signature; Solido's problem was its own misassignment and fallback logic, with SUPRA present as the token that was sold rather than as the broken component. Collapsing them into "Supra was exploited twice" would be wrong, and OAK records the distinction deliberately. What they genuinely share is the downstream gap: both consuming protocols accepted a wildly implausible collateral valuation without a deviation bound, and in both cases that single missing control would have converted a total drain into a rejected transaction irrespective of what went wrong upstream.

The fallback-logic framing is the part most worth generalising. Protocols have absorbed the lesson that oracles fail and have accordingly built staleness detection — but the handler that runs on staleness is written once, rarely exercised, and almost never fuzzed under the conditions that trigger it, because those conditions are by definition abnormal. Solido's fallback did not silently return a bad number in an obscure corner; it returned a number so far above market that it supported minting 809,052 CASH. Any protocol with a stale-feed fallback can perform the check this case argues for in an afternoon: force the feed stale on a fork, observe what the fallback prices each collateral asset at, and confirm the error direction is conservative.

Finally, the loss size deserves to be discounted, not the case. At roughly $900,000 with ~90% of it falling on the protocol's own foundation rather than on users, this is among the smallest entries in the July cohort. But severity here is a function of the protocol's size and treasury composition, not of the defect's quality — the identical misassignment and fallback in a system with a hundred times the collateral produces a hundred times the loss with no change in mechanism. The two-wave shape is the other durable contribution: an atomic first strike followed hours later by a manual repeat across fresh wallets is a behavioural signature contributors should record wherever it appears, because it marks the difference between a defect that was exploited and a defect that was exploited, observed to still be open, and returned to.