SummerFi exploit analysis

FleetCommander's share value is computed as the live sum of every Ark's totalAssets(). SummerFi's FleetA had a Silo-managed vgUSDC ark that credited the vault token with the full par value of its collateral, but whose underlying was Silo's wrapped-USDC position that priced a depegged external deposit at par. The Ark was empty at the time of the attack, which meant the redemption queue could substitute other contributors' USDC for the inflated share value with no totalAssets floor to catch it.

The attacker at 0x7bf716167b48cf527725722c6d79494b45b3bdca first minted vgUSDC at a depressed exchange value by routing USDT through Uniswap V4 into xUSD (the deposit) and then through Balancer V3 into vgUSDC. With a dominant share count in hand it donated the cheap vgUSDC into the empty FleetA ark to inflate the Ark's totalAssets(), then redeemed its inflated FleetA shares against the real contributors' DAI and USDC reserves. The redemption handed back DAI (and LVUSDC share) at the inflated rate while the underlying vgUSDC remained parked in the ark.

DeFiHackLabs reconstructs the attack against the live mainnet state via the historical attack contract at 0x0514f827c129c16418a0933e03c99a6af982fc61 and reports a total drained of 6.02M DAI. The exploit transaction is 0x0db528c44f23fc7fa4544684a2fab81096450a14aae8bc89f42cd0592d43da12 on Ethereum mainnet. The SummerFi writeup postulates the loss mixes DAI and LVUSDC shares to roughly $6M at the time.

What would have prevented it: a per-ark totalAssets() floor that excluded positions whose underlying is depegged or non-canonical. Without that floor the Ark read at par, and the redemption became an arithmetic pump.