Summer.fi has published a detailed post-mortem on the
The report says the attacker spent roughly three months accumulating the assets needed to manipulate the protocol. The exploit was executed in a single atomic transaction on
It also argues that the root cause was an operational issue during the offboarding of an old strategy rather than a flaw in the protocol’s smart contracts.
Attack exploited incomplete offboarding process
According to the post-mortem, the attacker
That artificially inflated the vault’s share price, allowing the attacker to redeem shares at an inflated value. The attacker then withdrew approximately
The losses were split between the
Summer.fi stressed that the exploit was not caused by compromised private keys, administrative privileges, or a coding bug. Instead, it said the affected contracts behaved as designed.
Still, an impaired Ark remained active in the vault’s accounting after its deposit cap had been set to zero.
Preparation began months before the exploit
The report also challenges the early narrative that the exploit was simply a flash loan attack.
Summer.fi said blockchain evidence indicates
The flash loans primarily provided temporary liquidity for the final transaction rather than creating the vulnerability itself.
The protocol also addressed a widely shared screenshot showing an annual percentage yield of roughly
Protocol paused as governance weighs next steps
Following the exploit, all Lazy Summer Protocol vaults were paused, and deposit caps were reduced to zero while the incident was investigated.
The report said governance must now decide how to handle the affected vaults, whether to compensate users, and when unaffected vaults can safely resume operations.
Final Summary
- Summer.fi said the $6.04 million exploit was planned over several months and stemmed from an incomplete vault offboarding process.
- The protocol has paused all vaults while governance considers compensation, remediation, and the safe reopening of unaffected markets.
