{"investigation":{"slug":"texture","entity_name":"Texture Finance","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Texture Finance is a Solana-based decentralized lending protocol founded in 2021 and backed by $5 million in venture funding from P2P Capital, Sino Global Capital, Wintermute, and Jane Street Capital. In July 2025, a missing ownership check in its USDC vault smart contract allowed an attacker to steal approximately $2.2 million in user funds; the protocol negotiated a 10% greyhat bounty and recovered roughly $1.98 million. User withdrawals remained disabled following the exploit, and a formal repayment timeline had not been published as of mid-2025.","sections":[{"content":"Texture Finance (also known as texture.fi) is a Solana-based decentralized finance protocol offering yield management, leveraged staking, and peer-to-peer lending services. The protocol is operated by a team based in Lisbon, Portugal, and was founded in 2021 by Oleg Ravnushkin and Igor Burlakov. In 2024 the team launched Texture 2.0, rebranding the platform as a modular lending protocol built around SuperLendy, a permissionless liquidity layer allowing users to create and manage lending pools and vaults on Solana.","heading":"Overview","sources":[{"url":"https://texture.gitbook.io/texture","name":"texture.gitbook.io","type":"other","credibility":3},{"url":"https://blockonomi.com/texture-finance-5-million-funding-round/","name":"blockonomi.com","type":"other","credibility":3},{"url":"https://tracxn.com/d/companies/texture-finance/__KJGEqO5NqgsaOMdbtR3E0uCPQUe-f709WyDzMTa0rR0","name":"tracxn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 9, 2025, Texture Finance publicly disclosed that an attacker had exploited a critical vulnerability in its USDC vault smart contract, draining approximately $2.2 million in user funds. The vulnerability was a missing ownership check in the vault's rebalance function: the contract validated that a destination token account held the expected LP token mint but failed to verify that the account was owned by the vault itself. An attacker supplied a controlled SPL Token account during a rebalancing operation, causing the contract to transfer LP tokens to the attacker's wallet. The attacker then redeemed those LP tokens against the underlying SuperLendy reserve for USDC. Upon detecting the attack, the team activated safe mode across all SuperLendy reserves to halt further outflows and convened a war room with auditors and security advisors. The team sent an on-chain message offering the attacker a 10% bounty ($220,000) to return the remaining 90% of funds. The attacker complied before a July 11 deadline, returning approximately $1.98 million in USDC. Texture stated it would not pursue further legal action given the attacker's cooperation. The patched contract subsequently underwent an independent formal verification review by Certora. User withdrawals were disabled following the exploit; as of mid-July 2025 no specific public timeline had been provided for resuming normal operations.","heading":"July 2025 Smart Contract Exploit","sources":[{"url":"https://www.web3isgoinggreat.com/?id=texture-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/texturefinancevaultrebalancemissingownershipchecktheft.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/9a6a3-texture-finance-hacker-refunds-loot","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/texture-finance-recovers-90-2-2-million-usdc-hacker-bounty-2507/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://www.okx.com/en-us/learn/defi-security-vulnerabilities-hacks","name":"okx.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The vulnerability exploited in July 2025 was present in a smart contract that had previously been audited. The missing ownership check on the rebalance function was not caught during the internal review process or the initial third-party audit prior to the Texture 2.0 launch. Certora was named as the auditing partner engaged for the post-exploit review of the patched contract. The exploit raised questions about the comprehensiveness of pre-deployment security review practices at the protocol, as the missing guard was described by security researchers as a basic but critical oversight that standard security workflows and automated testing frameworks should have identified.","heading":"Pre-Exploit Audit Failure","sources":[{"url":"https://www.quadrigainitiative.com/hackfraudscam/texturefinancevaultrebalancemissingownershipchecktheft.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/9a6a3-texture-finance-hacker-refunds-loot","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"In November 2022 Texture Finance announced the completion of a $5 million funding round co-led by P2P Capital and Sino Global Capital (also known as Sino Global Shipping America). Additional participants included Wintermute, Semantic Ventures, and Jane Street Capital. The funds were raised in USDC and the company's valuation was not disclosed. The involvement of reputable institutional investors such as Jane Street Capital and Wintermute lends some operational credibility to the project, though the exploit demonstrated that investor participation does not guarantee smart contract security.","heading":"Funding and Investors","sources":[{"url":"https://blockonomi.com/texture-finance-5-million-funding-round/","name":"blockonomi.com","type":"other","credibility":3},{"url":"https://coincodex.com/article/20870/texture-raises-5-million-to-build-solana-based-yield-management-tools/","name":"coincodex.com","type":"other","credibility":3},{"url":"https://cryptonews.net/news/defi/15539521/","name":"cryptonews.net","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit affected users who had deposited USDC into the Texture vault product. Following recovery of $1.98 million from the attacker, the protocol indicated that repayments were continuing in standard mode, meaning that outstanding loans and scheduled repayments remained active. Withdrawals were suspended pending redeployment of the patched vault contract. As of available reporting through mid-July 2025, Texture had not published a formal timeline for reopening withdrawals or a structured user compensation plan for the approximately $220,000 in funds retained by the attacker as the greyhat bounty. The absence of a published repayment plan represents an ongoing risk to affected depositors.","heading":"User Impact and Recovery Status","sources":[{"url":"https://cryptorank.io/news/feed/9a6a3-texture-finance-hacker-refunds-loot","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=texture-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/hacker-returns-90-stolen-funds-texture-protocol-2507/","name":"ainvest.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions, SEC or CFTC filings, or law enforcement proceedings have been identified against Texture Finance or its founders as of available records through mid-2026. The protocol stated it would not pursue legal action against the attacker following return of 90% of stolen funds. The protocol is incorporated outside the United States (team based in Lisbon, Portugal), which limits the applicability of US regulatory oversight. No OFAC sanctions entries have been identified for the entity or its principals.","heading":"Regulatory and Legal Status","sources":[{"url":"https://tracxn.com/d/companies/texture-finance/__KJGEqO5NqgsaOMdbtR3E0uCPQUe-f709WyDzMTa0rR0","name":"tracxn.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"Texture Finance founded by Oleg Ravnushkin and Igor Burlakov in Lisbon, Portugal as a Solana-based DeFi yield management protocol.","source":"","date_original":"2021-01-01"},{"date":"2022-11-02","event":"Texture Finance announces completion of $5 million funding round co-led by P2P Capital and Sino Global Capital, with Wintermute, Semantic Ventures, and Jane Street Capital participating.","source":""},{"date":"2024-09","event":"Texture launches Texture 2.0, a modular lending protocol on Solana built on SuperLendy, allowing permissionless creation and management of lending pools and vaults.","source":"","date_original":"2024-09-01"},{"date":"2025-07-09","event":"Texture Finance detects and discloses a critical exploit in its USDC vault smart contract. A missing ownership check in the rebalance function allows an attacker to drain approximately $2.2 million in USDC. The team activates safe mode, disables withdrawals, and sends an on-chain message offering a 10% bounty for return of the remaining 90% of stolen funds.","source":""},{"date":"2025-07-10","event":"The attacker returns approximately $1.98 million in USDC to Texture Finance's designated Solana address, retaining $220,000 as the agreed greyhat bounty. Texture states it will not pursue legal action.","source":""},{"date":"2025-07-11","event":"Texture Finance publishes follow-up update confirming fund recovery, noting that the patched contract is undergoing review with auditing partner Certora and that a post-mortem analysis is forthcoming. Withdrawals remain suspended pending redeployment.","source":""}],"sources_used":[{"url":"https://texture.gitbook.io/texture","name":"texture.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20260309122732/https://texture.gitbook.io/texture","credibility":3,"archive_timestamp":"2026-03-09T12:27:32+00:00"},{"url":"https://blockonomi.com/texture-finance-5-million-funding-round/","name":"blockonomi.com","type":"other","archive_url":"https://web.archive.org/web/20260829112442/https://blockonomi.com/introducing-self-the-web3-fraud-prevention-platform/","credibility":3,"archive_timestamp":"2026-08-29T11:24:42+00:00"},{"url":"https://tracxn.com/d/companies/texture-finance/__KJGEqO5NqgsaOMdbtR3E0uCPQUe-f709WyDzMTa0rR0","name":"tracxn.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=texture-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260519103853/https://www.web3isgoinggreat.com/?id=texture-hack","credibility":3,"archive_timestamp":"2026-05-19T10:38:53+00:00"},{"url":"https://www.quadrigainitiative.com/hackfraudscam/texturefinancevaultrebalancemissingownershipchecktheft.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260829051620/https://www.quadrigainitiative.com/hackfraudscam/texturefinancevaultrebalancemissingownershipchecktheft.php","credibility":3,"archive_timestamp":"2026-08-29T05:16:20+00:00"},{"url":"https://cryptorank.io/news/feed/9a6a3-texture-finance-hacker-refunds-loot","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260830032731/https://cryptorank.io/news/feed/9a6a3-texture-finance-hacker-refunds-loot","credibility":3,"archive_timestamp":"2026-08-30T03:27:31+00:00"},{"url":"https://www.ainvest.com/news/texture-finance-recovers-90-2-2-million-usdc-hacker-bounty-2507/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.okx.com/en-us/learn/defi-security-vulnerabilities-hacks","name":"okx.com","type":"other","archive_url":"http://web.archive.org/web/20250911060657/https://www.okx.com/en-us/learn/defi-security-vulnerabilities-hacks","credibility":3,"archive_timestamp":"2025-09-11T06:06:57+00:00"},{"url":"https://coincodex.com/article/20870/texture-raises-5-million-to-build-solana-based-yield-management-tools/","name":"coincodex.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptonews.net/news/defi/15539521/","name":"cryptonews.net","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ainvest.com/news/hacker-returns-90-stolen-funds-texture-protocol-2507/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:21.666144+00:00","updated_at":"2026-08-30T03:54:59.340426+00:00"}}