Summer.fi (Lazy Summer Protocol)
Summary
Summer.fi, a DeFi yield-optimization platform formerly known as Oasis.app that spun out of the Maker Foundation in 2021, operated the DAO-governed Lazy Summer Protocol until a July 6, 2026 exploit drained roughly $6.04 million from two of its USDC vaults via a flash-loan-funded share-price manipulation of the Fleet Commander accounting contract. Summer.fi's own post-mortem attributes the loss to an operational oversight — an old, capped strategy that was never fully removed from vault net-asset-value calculations — rather than a smart-contract bug or compromised keys. The Summer.fi Labs company announced on July 15, 2026 that it would wind down and shut off its app by August 31, 2026, leaving user compensation and the fate of roughly $4 million in illiquid affected-vault holdings to a future Lazy Summer DAO governance vote.
Connected Entities
1 entities · 10 linked investigationsTimeline(8 events)
2021-06-01
Oasis.app (later Summer.fi) spins out as an independent entity following the decentralization of the Maker Foundation.
Summer.fi official blog2023-06-01
Oasis.app rebrands to Summer.fi, expanding beyond its Maker-centric roots into a multi-protocol yield platform.
Summer.fi official blog2026-04-06
Attacker allegedly begins funding multiple wallets used later in the exploit, according to Summer.fi's post-mortem on-chain analysis.
Summer.fi post-mortem blog2026-07-06
At approximately 05:17 UTC, an attacker executes a single atomic transaction using a ~$65.4M flash loan to manipulate Fleet Commander vault share pricing, redeeming ~$70.9M against ~$64.8M deposited and netting roughly $6.04M in stolen USDC across two vaults.
Summer.fi post-mortem blog / The Block2026-07-06
Blockaid flags the exploit at approximately 05:36 UTC; Summer.fi zeroes deposit caps by 06:42 UTC and pauses Ethereum/Base vaults by 10:25 UTC, then Arbitrum/Sonic vaults by 11:38 UTC.
Summer.fi post-mortem blog2026-07-06
News outlets including CoinDesk and The Block report the exploit and Summer.fi's vault pause.
CoinDesk / The Block2026-07-15
Summer.fi Labs announces it will wind down the company and shut off the Summer.fi app by August 31, 2026, citing the exploit's financial impact.
Summer.fi official blog2026-08-31
Planned date for the Summer.fi application and support channels to cease operating.
Summer.fi official blogDecision Log
- #1publish⛓ pending7/22/2026, 1:56:44 AMhash: DSpaQaaeVSTh3bcm6qZZzFGAupXvDwfiDwENV5XvWhx4
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 7/22/2026, 1:53:55 AM
last updated: 7/22/2026, 1:56:44 AM
avoid.net — verified advice for a post-truth world