Worked example · 2026-07

Summer.fi (Lazy Summer Protocol) — a market capped for offboarding stays priced into vault NAV, so a donation of stale Stream-Finance-era tokens inflates the share price for an atomic redemption — Summer.fi / Lazy Summer (Ethereum) — 2026-07-06

Loss: ~$6.04M realised, extracted in a single atomic transaction from two Lazy Summer Protocol USDC vaults on Ethereum mainnet: LazyVault_LowerRisk_USDC (~5.64M USDC) and LazyVault_HigherRisk_USDC (~0.40M USDC). The attacker exited in DAI. The payout came from other depositors' genuinely liquid positions, not from the manipulated market itself. Roughly $4M of illiquid vault capital remained stranded pending a governance decision. Vaults across Ethereum, Base, Arbitrum, Sonic, and HyperEVM were paused as a precaution; only the two Ethereum USDC vaults lost funds. Summer.fi Labs subsequently announced it was winding down, with the Lazy Summer Protocol left under DAO control.
OAK Techniques observed: OAK-T9.001 (Oracle Price Manipulation — primary, confirmed mechanism, in its book-value / yield-bearing-token sub-shape: the vault's share price is computed from totalAssets() across its active market set, so donating an over-valued token into any market still in that set raises reported NAV with no real assets behind the increase. The attacker donated Silo "Varlamore USDC Growth" vault tokens — carrying a stale on-chain valuation ever since the November 2025 Stream Finance collapse — into an Ark that had been capped for offboarding but never removed from the priced set, lifting NAV by roughly 9.5%, then redeemed at the inflated share price. This is the Cream / Rari-Fuse donation pattern with an operational twist: the manipulable market was one the protocol had already decided to retire. See techniques/T9.001-oracle-price-manipulation.md). OAK-T9.002 (Flash-Loan-Enabled Exploit — the enabling capital: ~65.4M USDC flash-borrowed to take a position large enough that a 9.5% NAV lift was worth $6M, with deposit, donation, redemption, and repayment all inside one transaction. See techniques/T9.002-flash-loan-enabled-exploit.md). Proceeds were routed through Tornado Cash, OAK-T7.001.
Attribution: pseudonymous. No named individual or group. On-chain identifiers: the funder and beneficiary EOA 0x7BF716167B48CF527725722C6d79494b45B3BDCa and the executor contract 0x0514F827C129C16418a0933E03C99A6AF982FC61. The wallet cluster was funded through a single shared path on 2026-04-06 and spent the following weeks accumulating the stale Silo positions — three months of preparation before execution, which places this well outside opportunistic discovery. Proceeds moved through Tornado Cash, indicating no intent to negotiate a return. Nothing links the operator to a tracked OAK actor.
Key teaching point: Zeroing a deposit cap stops new money going in; it does not stop the market counting toward what your vault says it is worth. The Ark holding the impaired Silo position had been capped at zero in October 2025 as the first step of offboarding, and everyone involved understood it was being retired. But capping and removing are different operations, and only removal takes a market out of the set that feeds totalAssets(). That left an impaired, manipulable market influencing the share price for months — through the November 2025 Stream Finance collapse that made its tokens stale, and on into July 2026. The post-mortem is unusually honest that this was not a code defect: the contracts did exactly what they were written to do. The vulnerability was a process that had a deactivation step and a removal step with an open-ended window between them, and nobody treated that window as an exposure. The generalisable control is that an offboarding decision must remove the market from the pricing set in the same action that stops inflows, and that any asset whose market has become impaired must be de-priced immediately rather than left carrying its last-known-good valuation while it awaits cleanup. The three-month preparation is the second lesson: the attacker was accumulating position in April against a flaw that had been sitting open since October.

Summary

Lazy Summer Protocol is Summer.fi's yield-vault system. Each vault allocates depositor capital across a set of underlying markets, called Arks, and computes its share price from totalAssets() summed across the Arks in its active set. A depositor's redemption pays out at that share price.

In October 2025, a Silo "Varlamore USDC Growth" Ark was capped for offboarding — its deposit cap set to zero, blocking new inflows, as the first step toward retiring it. Zeroing the cap does not remove an Ark from the active set, so it continued to be counted in vault NAV. In November 2025, the collapse of Stream Finance (whose xUSD fell 77% after an external fund manager disclosed a $93M loss) left the Silo Varlamore vault tokens carrying an on-chain valuation far above their real worth. The impaired market was now both stale-priced and still influencing the share price, waiting on a removal step that had not yet come.

Beginning 2026-04-06, an attacker funded a set of wallets through a single shared path and, from 2026-04-09, spent weeks accumulating those stale Silo Varlamore tokens.

On 2026-07-06 at 05:17 UTC, the attacker executed in one atomic transaction: flash-borrowed ~65.4M USDC; deposited ~64.8M USDC into the two Lazy Summer USDC vaults at the honest share price of ~1.0665 USDC/share; donated the accumulated over-valued Silo tokens into the capped-but-active Ark, lifting reported NAV by ~9.5%; redeemed the freshly-minted shares at the inflated price of ~1.1678 USDC/share; repaid the flash loans; and exited with ~$6.04M in DAI. The redemption was funded out of the vaults' genuinely liquid assets — that is, out of other depositors' capital.

Blockaid flagged the transaction 19 minutes later. Block Analitica froze deposits at 06:42, and the Guardian module — a 6-of-8 multisig deliberately constrained to only pausing vaults and setting deposit caps — paused Ethereum and Base vaults at 10:25 and Arbitrum and Sonic at 11:38. The Guardian role had not been deployed on HyperEVM, so the Foundation intervened there, though deposits were already capped and the same vector was blocked. At 16:39 the Foundation swept the over-valued Silo tokens out of the affected vault to stop the NAV distortion. SEAL 911 was engaged to trace funds.

Timeline (UTC)

When	Event	OAK ref
2025-10	Silo "Varlamore USDC Growth" Ark capped at zero for offboarding; remains in the active set and continues to be priced into vault NAV	(standing T9.001 surface)
2025-11	Stream Finance collapses; xUSD falls 77% after a $93M loss disclosed by an external fund manager. The Silo Varlamore tokens are left carrying a stale on-chain valuation far above real worth	(impairment)
2026-04-06	Attacker funds a set of wallets through a single shared path	(preparation)
2026-04-09 onward	Those wallets accumulate the stale-valued Silo "Varlamore USDC Growth" tokens	(preparation)
2026-07-06 05:17	Attacker consolidates the tokens into the executor contract and fires: flash-borrow ~65.4M USDC → deposit ~64.8M at ~1.0665 USDC/share → donate over-valued Silo tokens into the capped Ark (NAV +~9.5%) → redeem at ~1.1678 USDC/share → repay → exit ~$6.04M DAI	T9.002 → T9.001
2026-07-06 05:36	Blockaid flags the transaction as a live exploit	(detection)
2026-07-06 06:42	Block Analitica freezes deposits on the affected vaults	(containment)
2026-07-06 07:52	Guardian signers alerted; pause transactions queued	(containment)
2026-07-06 10:25	Guardian transactions execute; Ethereum and Base vaults paused	M34
2026-07-06 11:38	Arbitrum and Sonic vaults paused	M34
2026-07-06 16:39	Foundation sweeps the over-valued Silo tokens from the affected vault, halting the NAV distortion	(remediation)
post-event	Proceeds routed through Tornado Cash; SEAL 911 engaged for tracing; Summer.fi Labs announces wind-down, Lazy Summer Protocol remains under DAO control	T7.001

What defenders observed

Pre-event (a retirement decision that stopped inflows but not pricing). The exposure was open from October 2025: an Ark capped at zero, understood internally to be on its way out, still counted in totalAssets(). The control is to make removal from the pricing set part of the same action that zeroes the cap, so no window exists in which a market is both retired-in-intent and live-in-pricing. Where a staged offboarding is genuinely necessary, the window is an exposure that needs an owner and a deadline, not an open-ended cleanup task.
Pre-event (an impaired market left carrying its last-known-good price). Stream Finance's November 2025 collapse is what turned a dormant process gap into a $6M one, by making the capped Ark's tokens stale-priced. Any asset whose underlying market becomes impaired should be de-priced or hard-zeroed in NAV immediately on impairment, independent of whatever offboarding queue it sits in. Watching upstream counterparty failures for downstream pricing consequences is the pre-event control that fires in November, eight months before the loss.
At-event (donation into a priced market with no real inflow). The direct signature is totalAssets() rising without a corresponding deposit — a token transfer into an Ark that lifts NAV outside the deposit path. A runtime invariant that share price may only move via accounted inflows, plus rejection of donations into any Ark not accepting deposits, is the highest-leverage at-event control for this class.
At-event (deposit and redeem at materially different share prices in one transaction). The vault minted shares at ~1.0665 and redeemed at ~1.1678 inside a single atomic transaction. Share price moving within one transaction is the flash-loan-resistance signal (T9.002): a vault whose pricePerShare is sensitive to same-transaction state is the persistent surface here.
Detection (fast alert, slow hands). Blockaid flagged at 05:36, 19 minutes after execution — but the money left in the same transaction it entered. Nothing in the 05:36-to-10:25 response window could have changed the outcome; the pause protected everything after the event. This is worth stating plainly because a fast detection metric can otherwise read as a near-miss when it was not one. The controls that would have mattered were all pre-event.
Response (a deliberately weak emergency power, and a gap in it). The Guardian is a 6-of-8 multisig constrained by design to only pause and cap — it cannot move funds. That constraint is a reasonable trust trade-off and it worked as intended. The finding is that the Guardian had not been deployed on HyperEVM, requiring Foundation intervention on a chain where the vector happened to already be blocked. Emergency-power deployment coverage should be audited per-chain, not assumed from the deployment of the vaults themselves.

Public references

[summerfipostmortem2026] — Summer.fi, "Lazy Summer USDC Vault Exploit Post-Mortem: What Happened and What Comes Next" (primary operator post-mortem: per-vault losses, share prices 1.0665 → 1.1678, ~9.5% NAV inflation, the capped-but-active Ark root cause, attacker addresses, April preparation, full UTC timeline, Guardian scope and HyperEVM gap): https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/
[coindesksummerfi2026] — CoinDesk, "DeFi protocol Summer.fi halts Lazy Summer vaults after $6 million exploit" (contemporaneous disclosure, pause across chains): https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit
[cryptotimessummerfi2026] — The Crypto Times, "$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse" (the Stream Finance / Silo Varlamore stale-valuation chain, xUSD 77% fall, $93M external-manager loss): https://www.cryptotimes.io/2026/07/08/6m-lazy-summer-exploit-traces-back-to-novembers-stream-finance-collapse/
[bitcoinnewssummerfi2026] — Bitcoin.com News, "Summer Finance Pauses Vaults After $65.4M Flash Loan Attack Triggers $6M Loss" (flash-loan size, guardian pause, deposit caps to zero): https://news.bitcoin.com/summer-finance-pauses-vaults-after-65-4m-flash-loan-attack-triggers-6m-loss/
[ambcryptosummerfi2026] — AMBCrypto, "Summer.fi reveals months-long preparation behind $6M DeFi exploit" (April 2026 wallet funding and position accumulation as premeditation): https://ambcrypto.com/summer-fi-reveals-months-long-preparation-behind-6m-defi-exploit/

Discussion

This case belongs in OAK's T9.001 book-value family next to Cream (October 2021) and the Rari/Fuse cohort (April 2022), and the donation mechanic is identical to both: raise a vault's reported assets without a real inflow, redeem against the inflation, let other depositors fund the payout. What Summer.fi adds is that the manipulable market was one the protocol had already decided to get rid of. That is a more uncomfortable finding than a mispriced integration nobody had reviewed, because every human in the loop had correctly identified the Ark as something to retire — in October 2025, eight months before the loss. The gap was purely that "stop new deposits" and "stop counting it in the price" were separate operations with no deadline binding the second to the first.

The Stream Finance dependency is what makes the case worth preserving beyond its size. The Ark was capped in October and was merely dormant; it became dangerous in November when an unrelated protocol's collapse froze its tokens at a stale valuation. Neither event alone produces a $6M loss. The lesson for vault operators is that an offboarding queue is a standing inventory of markets you have stopped watching but are still pricing, and an upstream counterparty failure can convert any entry in it into a live exploit primitive without anything changing in your own system. Teams should be able to answer, at any moment, which markets are in the priced set that they no longer actively monitor — and the honest answer to that question is what the post-mortem calls the true root cause.

The three-month preparation deserves its own note for investigators. Wallets funded through a shared path on 2026-04-06, position accumulated from 2026-04-09, execution on 2026-07-06: this is funder-graph-shaped (M04), and the accumulation of a stale, illiquid, offboarded vault token by a fresh wallet cluster is itself an anomalous signal that had no consumer. Nobody was watching for "who is buying the impaired asset our vault still prices", which is a monitorable question with a small, tractable answer set.