{"investigation":{"slug":"goonfi","entity_name":"GoonFi","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.62,"status":"published","content_type":"investigation","summary":"GoonFi is a proprietary automated market maker (Prop AMM) operating on Solana, launched in June 2025 with no public team, no frontend, and no published smart-contract audit. On March 28, 2026, a protocol logic vulnerability was exploited via mispricing arbitrage, resulting in approximately $254,000 in losses with no recovery reported. The protocol has been flagged by ZachXBT and is cited by researchers as representative of a broader Solana centralization concern, wherein anonymous, closed-source market makers capture an outsized share of DEX volume with minimal accountability.","sections":[{"content":"GoonFi is a Solana-based proprietary automated market maker (Prop AMM) that launched in June 2025. Unlike traditional open DEXs such as Raydium or Orca, GoonFi operates without a public-facing frontend, published interface description language (IDL), documentation, or community governance forum. Liquidity is entirely controlled internally, and pricing algorithms are not publicly disclosed. The protocol's primary Solana program address is referenced in on-chain data as beginning 'goonER…BnS5j'. By July 2025, aggregator-driven trades through Jupiter accounted for 99.2% of all GoonFi volume, indicating near-total dependence on a single routing source. Cumulative DEX volume on DeFiLlama reached approximately $29.8 billion as of May 2026, while measured total value locked (TVL) stands at $0 due to the Prop AMM model not holding deposits from external liquidity providers.","heading":"Protocol Overview","sources":[{"url":"https://defillama.com/protocol/goonfi","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","name":"helius.dev","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 28, 2026, GoonFi suffered a protocol logic exploit classified as a mispricing arbitrage attack. The attacker identified GoonFi as a target by analyzing on-chain data, TVL exposure, and contract logic to locate mispricing arbitrage vulnerabilities within the Solana Rust/Anchor program. Approximately $254,000 was drained. According to a post-mortem published on X (Twitter) by the handle 'cetipo' (referenced at https://x.com/cetipo/status/2037892924982038893), the exploit required technical expertise in arbitrage mechanics, Solana programming, and precise transaction timing. After extracting funds, the attacker is alleged to have moved assets through mixers or cross-chain bridges to obscure the trail, converting proceeds to more liquid or privacy-preserving assets. No recovery of funds has been reported. The incident is classified as a protocol logic vulnerability by SmartContractHacking.com, which notes the vulnerability 'could have been caught in audit.' Security guidance following the incident recommends verifying that all logic paths related to mispricing arbitrage are guarded by access controls, that state-changing functions follow the Checks-Effects-Interactions (CEI) pattern, and that oracle price feeds are audited for manipulation risks.","heading":"Protocol Logic Exploit — March 2026","sources":[{"url":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/goonfi","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"GoonFi's team is entirely anonymous. No founders, developers, or organizational affiliates have been publicly identified. The protocol operates without a website, social media presence, or community channels of its own. Researchers writing for Incrypted noted: 'The GoonFi team is anonymous, and its liquidity sources and the details of how its software works remain unknown.' A CoinMonks analysis similarly categorized GoonFi among 'newcomers such as HumidiFi, ZeroFi and GoonFi, often linked to professional market-making firms,' without any confirmed attribution. Helius developer research states GoonFi 'is operated by professional DeFi market-making firms and Solana-native teams that have so far chosen to keep their involvement under the radar.' The complete absence of publicly identifiable operators means there is no accountable party in the event of additional security incidents, regulatory action, or user disputes. Anonymous operators ZeroFi and GoonFi are described as 'unverified, sparking concerns within the Solana community about hidden influence and potential manipulation.'","heading":"Team Anonymity and Transparency Concerns","sources":[{"url":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","name":"incrypted.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","name":"medium.com","type":"other","credibility":3},{"url":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","name":"helius.dev","type":"other","credibility":3}],"severity":"medium"},{"content":"GoonFi is part of a broader wave of proprietary AMMs on Solana that researchers have characterized as a 're-centralization' of DeFi. Unlike traditional DEXs where liquidity providers are independent community members, Prop AMMs concentrate liquidity and pricing power within single anonymous entities. GoonFi holds approximately 6% of the Prop AMM market on Solana, processing around $113 million in daily volume at peak. Dan Smith, a DeFi researcher, noted on X in July 2025: 'A new prop AMM named GoonFi popped up on Solana. It is doing $25-50m in daily volume with one active pair (SOL-USD).' Industry commentary in Benzinga described the Prop AMM category as 'DeFi's new landlords,' arguing that if proprietary AMMs proliferate unchecked, DeFi's balance of power tilts away from community-supplied liquidity toward vertically integrated, opaque entities. GoonFi's closed-source code prevents independent security audits, and the lack of a public IDL means external researchers cannot verify the protocol's logic or identify vulnerabilities before they are exploited — a structural gap that the March 2026 hack demonstrated in practice.","heading":"Centralization and Systemic Risk","sources":[{"url":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","name":"incrypted.com","type":"other","credibility":3},{"url":"https://x.com/smyyguy/status/1941500890336329733","name":"x.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","name":"medium.com","type":"other","credibility":3},{"url":"https://www.benzinga.com/Opinion/25/10/48120742/defi-new-landlords","name":"benzinga.com","type":"other","credibility":3}],"severity":"medium"},{"content":"GoonFi has an associated GF token deployed on Solana (contract address: 6kKBtdEoStQoHg1cTmjiXkRvEpyin1gadJctCoRPiT6f on Solscan). Total supply is approximately 999.09 million GF, against a maximum supply cap of 1 billion. The token reached an all-time high in August 2025 before declining substantially; as of mid-2026 the 24-hour trading volume is approximately $702, indicating near-zero market activity and severely diminished liquidity. Mint authority and freeze authority are reported as disabled, which are standard security configurations for a launched token. However, the extremely low current liquidity (reported at approximately $17,000 with a 31% 24-hour drop at one point post-exploit) introduces significant slippage risk and potential for price manipulation for any remaining holders. The GF token is separately distinct from GoonFi's DEX protocol; the Prop AMM itself generates volume by acting as a liquidity backend rather than through its own token, and the relationship between GF token holders and protocol governance (if any) is not publicly documented.","heading":"GF Token and Market Data","sources":[{"url":"https://solscan.io/token/6kKBtdEoStQoHg1cTmjiXkRvEpyin1gadJctCoRPiT6f","name":"solscan.io","type":"other","credibility":3},{"url":"https://cryptorank.io/price/goonfi","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/goonfi","name":"coingecko.com","type":"other","credibility":3},{"url":"https://dexscreener.com/solana/8hbubwoji41pnxjoqhgtjimhpwmtoeytoqmy8h4be5cz","name":"dexscreener.com","type":"other","credibility":3}],"severity":"medium"},{"content":"GoonFi has been flagged by ZachXBT, the pseudonymous on-chain investigator known for exposing crypto fraud and security incidents. The specific nature and timing of ZachXBT's flag has not been independently confirmed through a publicly archived primary source at the time of this investigation; however, the flag is consistent with ZachXBT's documented pattern of alerting on anonymous, unaudited DeFi protocols that have experienced security incidents. Community-level concerns about GoonFi predate the March 2026 exploit, with researchers noting in mid-2025 that anonymous Solana Prop AMMs including GoonFi operate outside the accountability norms expected of DeFi protocols. Following the March 2026 hack, no public statement was issued by any identified GoonFi team member, and no compensation or recovery plan has been announced, which community observers note as consistent with the opacity that characterizes the project's entire operational posture. All claims regarding the specific ZachXBT flag should be treated as low-to-medium confidence absent a directly archived primary source.","heading":"ZachXBT Flag and Community Warnings","sources":[{"url":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","name":"incrypted.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No public security audit of GoonFi's smart contracts has been identified. The protocol operates as closed-source, meaning independent security researchers cannot review its code without special access. This is noted explicitly by multiple researchers: the Incrypted analysis flags 'security vulnerabilities due to closed-source code preventing independent audits' as a key risk factor for GoonFi and similar Prop AMMs. The March 2026 exploit directly resulted from a protocol logic flaw that, per SmartContractHacking.com, 'could have been caught in audit.' The lack of a bug bounty program, responsible disclosure policy, or published security contact means researchers have no formal channel to report vulnerabilities. GoonFi's oracle update frequency is described as 'one of the lowest among competitors,' which may increase exposure to price manipulation or stale-price arbitrage attacks, though this alone does not constitute evidence of malicious intent.","heading":"Absence of Audits and Security Infrastructure","sources":[{"url":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","name":"incrypted.com","type":"other","credibility":3},{"url":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","name":"helius.dev","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025","event":"ZeroFi, an early Solana Prop AMM peer, begins operations on Solana ahead of GoonFi's launch.","source":"","date_original":"2025-01-01"},{"date":"2025-06","event":"GoonFi launches on Solana as a proprietary AMM with a single active trading pair (SOL-USD), no public team, and no frontend.","source":"","date_original":"2025-06-01"},{"date":"2025-07-04","event":"Dan Smith (X: @smyyguy) publicly notes GoonFi's emergence, citing $25–50 million in daily volume on a single SOL-USD pair.","source":""},{"date":"2025-07","event":"Data shows 99.2% of GoonFi volume is aggregator-driven via Jupiter, indicating near-total routing dependency.","source":"","date_original":"2025-07-01"},{"date":"2025-08-26","event":"GF token reaches its all-time high price before beginning a sustained decline.","source":""},{"date":"2026-03-28","event":"GoonFi exploited via mispricing arbitrage attack on Solana; approximately $254,000 drained. Funds allegedly moved through mixers. No recovery reported. Post-mortem published by 'cetipo' on X.","source":""},{"date":"2026-03-28","event":"ZachXBT flags GoonFi following the exploit. No public team response or compensation plan issued.","source":""},{"date":"2026-05-28","event":"GoonFi DEX cumulative volume stands at approximately $29.8 billion per DeFiLlama, while GF token 24-hour trading volume is approximately $702. Protocol TVL remains at $0.","source":""}],"sources_used":[{"url":"https://defillama.com/protocol/goonfi","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251002192849/https://defillama.com/protocol/goonfi","credibility":3,"archive_timestamp":"2025-10-02T19:28:49+00:00"},{"url":"https://www.helius.dev/blog/solanas-proprietary-amm-revolution","name":"helius.dev","type":"other","archive_url":"http://web.archive.org/web/20260415004626/https://www.helius.dev/blog/solanas-proprietary-amm-revolution","credibility":3,"archive_timestamp":"2026-04-15T00:46:26+00:00"},{"url":"https://medium.com/coinmonks/centralization-again-4a8c774b2bdd","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://smartcontractshacking.com/hacks/goonfi-hack-2026","name":"smartcontractshacking.com","type":"other","archive_url":"https://web.archive.org/web/20260829041242/https://smartcontractshacking.com/hacks/goonfi-hack-2026","credibility":3,"archive_timestamp":"2026-08-29T04:12:42+00:00"},{"url":"https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","name":"incrypted.com","type":"other","archive_url":"http://web.archive.org/web/20260228183536/https://incrypted.com/en/how-dark-pools-are-changing-defi-and-what-it-means-industry/","credibility":3,"archive_timestamp":"2026-02-28T18:35:36+00:00"},{"url":"https://x.com/smyyguy/status/1941500890336329733","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.benzinga.com/Opinion/25/10/48120742/defi-new-landlords","name":"benzinga.com","type":"other","archive_url":"http://web.archive.org/web/20251029150241/https://www.benzinga.com/Opinion/25/10/48120742/defi-new-landlords","credibility":3,"archive_timestamp":"2025-10-29T15:02:41+00:00"},{"url":"https://solscan.io/token/6kKBtdEoStQoHg1cTmjiXkRvEpyin1gadJctCoRPiT6f","name":"solscan.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/price/goonfi","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20260210183247/https://cryptorank.io/price/goonfi","credibility":3,"archive_timestamp":"2026-02-10T18:32:47+00:00"},{"url":"https://www.coingecko.com/en/coins/goonfi","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20251004200634/https://www.coingecko.com/en/coins/goonfi","credibility":3,"archive_timestamp":"2025-10-04T20:06:34+00:00"},{"url":"https://dexscreener.com/solana/8hbubwoji41pnxjoqhgtjimhpwmtoeytoqmy8h4be5cz","name":"dexscreener.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:17.865683+00:00","updated_at":"2026-08-29T12:34:16.829598+00:00"}}