Main takeaway: An attacker stole about $6.04M from Lazy Summer Protocol's USDC vaults on July 6 by exploiting a NAV calculation flaw. They used flash loans to inflate share price via an unused Ark strategy that counted overvalued assets; Lowerrisk lost ~$5.64M and Higherrisk ~$0.40M. The protocol paused vaults, set deposit caps to zero, and is working with Seal911, Blockaid, Certik, PeckShield, and Cyvers to track funds while compensation will be decided by Lazy Summer DAO.
币界网消息，吴说获悉，Summer Fi发布了关于Lazy Summer Protocol USDC金库攻击的复盘报告。报告称，攻击者于7月6日利用两只以太坊USDC金库净值（NAV）计算机制的缺陷，通过闪电贷操纵份额价格，窃取约604万美元资产。其中，Lowerrisk USDC金库损失约564万美元，Higherrisk USDC金库损失约40万美元。报告指出，问题并非合约代码漏洞或私钥泄露，而是在已停止使用但仍计入NAV的Ark策略中注入被高估资产，导致金库份额价格虚增并完成套利。事件发生后，协议暂停所有Vault并将存款上限设为零，团队正与Seal 911、Blockaid、Certik、PeckShield、Cyvers等合作追踪资金流向，赔偿方案将由Lazy Summer DAO治理决定。