Summer.fi releases analysis of the Lazy Summer protocol attack, involving $6.04 million in funds

Summer.fi released an analysis report on the Lazy Summer Protocol USDC vault attack. On July 6, the attacker manipulated the price of two USDC vault shares in a single atomic transaction, extracting approximately 6.04 million USD from depositors. The attack was caused by a flaw in the vault’s Net Asset Value (NAV) calculation mechanism. The attacker donated tokens to a Silo Ark that had been paused but not fully removed, causing the vault’s total assets to be artificially inflated by about 9.5%. This led to a higher share price, following which the attacker redeemed at the inflated price and withdrew from the vault’s liquidity. The report points out that this attack was not due to a contract code bug, but rather a missing step in the vault’s decommissioning process — although the Ark’s deposit limit was set to zero, it was still included in the NAV among active assets.