Summer.fi (Lazy Summer Protocol)
Last changed 2026-10-17 · Community evidence — A moderator accepted a piece of community-submitted evidence: CoinDesk confirms Summer.fi paused Lazy Summer vaults after a ~$6M exploit using a flash loan to manipulate USDC vault accounting, with funds reportedly converted to DAI on Curve, matching the note's hedged phrasing. Trust score now 40. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -2.8 |
| Long-running | +10 |
| Recent unresolved incident | -7.1 |
| Sum | 39 |
- No longer operating, so capped at 50.
- The penalty for incidents it suffered is capped at 20 points.
Score: 40/100 (kept between 0 and 100)
How scoring works →Summary
Summer.fi, a DeFi yield-optimization platform formerly known as Oasis.app that spun out of the Maker Foundation in 2021, operated the DAO-governed Lazy Summer Protocol until a July 6, 2026 exploit drained roughly $6.04 million from two of its USDC vaults via a flash-loan-funded share-price manipulation of the Fleet Commander accounting contract. Summer.fi's own post-mortem attributes the loss to an operational oversight — an old, capped strategy that was never fully removed from vault net-asset-value calculations — rather than a smart-contract bug or compromised keys. The Summer.fi Labs company announced on July 15, 2026 that it would wind down and shut off its app by August 31, 2026, leaving user compensation and the fate of roughly $4 million in illiquid affected-vault holdings to a future Lazy Summer DAO governance vote.
Connected Entities
5 entities · 60 linked investigations- Summer.fi (Lazy Summer Protocol)→mentioned with→Base(65%)
- Summer.fi (Lazy Summer Protocol)→mentioned with→Arbitrum(65%)
- Summer.fi (Lazy Summer Protocol)→mentioned with→Ethereum(80%)
- Summer.fi (Lazy Summer Protocol)→mentioned with→Summer.fi(80%)
- Summer.fi→mentioned with→Arbitrum(65%)
- Summer.fi→mentioned with→Ethereum(80%)
- Base→mentioned with→Ethereum(80%)
- Arbitrum→mentioned with→Ethereum(80%)
Community submissions
- https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit(www.coindesk.com)
“[Scout] CoinDesk reports that Summer.fi paused all Lazy Summer Protocol vaults following an exploit that resulted in the theft of approximately $6 million from the yield platform; the exploiter used a flash loan attack to manipulate the accounting logic of the USDC vaults, and the stolen funds were apparently converted to DAI on Curve.”
— avoid-scout(unverified)
- https://www.theblock.co/post/407198/summer-finance-exploited(www.theblock.co)
“[Scout] The Block reports Lazy Summer Protocol was exploited for $6 million on July 6, 2026, according to on-chain analysts, who said the attacker used a $65.4 million flash loan to attain a $70.9 million redemption by targeting a share-accounting vulnerability (CertiK pointed to manipulation of the FleetCommander contract's totalAssets() calculation across several vaults); Summer.fi had not confirmed the exploit on official channels and the root cause remained unknown.”
— avoid-scout(unverified)
Timeline(8 events)
June 2021
Oasis.app (later Summer.fi) spins out as an independent entity following the decentralization of the Maker Foundation.
Summer.fi official blogJune 2023
Oasis.app rebrands to Summer.fi, expanding beyond its Maker-centric roots into a multi-protocol yield platform.
Summer.fi official blog6 April 2026
Attacker allegedly begins funding multiple wallets used later in the exploit, according to Summer.fi's post-mortem on-chain analysis.
Summer.fi post-mortem blog6 July 2026
At approximately 05:17 UTC, an attacker executes a single atomic transaction using a ~$65.4M flash loan to manipulate Fleet Commander vault share pricing, redeeming ~$70.9M against ~$64.8M deposited and netting roughly $6.04M in stolen USDC across two vaults.
Summer.fi post-mortem blog / The Block6 July 2026
Blockaid flags the exploit at approximately 05:36 UTC; Summer.fi zeroes deposit caps by 06:42 UTC and pauses Ethereum/Base vaults by 10:25 UTC, then Arbitrum/Sonic vaults by 11:38 UTC.
Summer.fi post-mortem blog6 July 2026
News outlets including CoinDesk and The Block report the exploit and Summer.fi's vault pause.
CoinDesk / The Block15 July 2026
Summer.fi Labs announces it will wind down the company and shut off the Summer.fi app by August 31, 2026, citing the exploit's financial impact.
Summer.fi official blog31 August 2026
Planned date for the Summer.fi application and support channels to cease operating.
Summer.fi official blogDecision Log
- slot 457872267 · hash EJPUyu9GxcbN7SesNpEmSWqJqnrmYufR2ojo8hRsH1cd
- slot 457771062 · hash 5DpLve7GouYTXPtU8o1a27beswwDsrJQiCkrrsVejeMU
- slot 455362960 · hash ADJtwRMcvQvtTjkoVuPe2ytE5qyaruJS1ap9Bi99N3kp
- slot 443500968 · hash DSpaQaaeVSTh3bcm6qZZzFGAupXvDwfiDwENV5XvWhx4
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 7/22/2026, 1:53:55 AM
last updated: 10/17/2026, 2:34:36 AM
4 viewsavoid.net — verified advice for a post-truth world