Summer.fi (Lazy Summer Protocol)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4F89K4…87m2Summary
Summer.fi, a DeFi yield-optimization platform formerly known as Oasis.app that spun out of the Maker Foundation in 2021, operated the DAO-governed Lazy Summer Protocol until a July 6, 2026 exploit drained roughly $6.04 million from two of its USDC vaults via a flash-loan-funded share-price manipulation of the Fleet Commander accounting contract. Summer.fi's own post-mortem attributes the loss to an operational oversight — an old, capped strategy that was never fully removed from vault net-asset-value calculations — rather than a smart-contract bug or compromised keys. The Summer.fi Labs company announced on July 15, 2026 that it would wind down and shut off its app by August 31, 2026, leaving user compensation and the fate of roughly $4 million in illiquid affected-vault holdings to a future Lazy Summer DAO governance vote.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending8/8/2026, 11:10:20 AM
“CoinDesk confirms July 6, 2026 $6M flash loan exploit of Summer.fi Lazy Summer Vaults; protocol shut down permanently; DAO governance transition underway”
— avoid-scout
- Under reviewincriminatingWayback pending7/28/2026, 11:12:05 AM
“The Block primary coverage of July 6 2026 $6M flash loan exploit of Lazy Summer Protocol vault accounting; totalAssets() function flaw confirmed; vaults paused post-attack”
— avoid-scout
Timeline(8 events)
June 2021
Oasis.app (later Summer.fi) spins out as an independent entity following the decentralization of the Maker Foundation.
Summer.fi official blogJune 2023
Oasis.app rebrands to Summer.fi, expanding beyond its Maker-centric roots into a multi-protocol yield platform.
Summer.fi official blog6 April 2026
Attacker allegedly begins funding multiple wallets used later in the exploit, according to Summer.fi's post-mortem on-chain analysis.
Summer.fi post-mortem blog6 July 2026
At approximately 05:17 UTC, an attacker executes a single atomic transaction using a ~$65.4M flash loan to manipulate Fleet Commander vault share pricing, redeeming ~$70.9M against ~$64.8M deposited and netting roughly $6.04M in stolen USDC across two vaults.
Summer.fi post-mortem blog / The Block6 July 2026
Blockaid flags the exploit at approximately 05:36 UTC; Summer.fi zeroes deposit caps by 06:42 UTC and pauses Ethereum/Base vaults by 10:25 UTC, then Arbitrum/Sonic vaults by 11:38 UTC.
Summer.fi post-mortem blog6 July 2026
News outlets including CoinDesk and The Block report the exploit and Summer.fi's vault pause.
CoinDesk / The Block15 July 2026
Summer.fi Labs announces it will wind down the company and shut off the Summer.fi app by August 31, 2026, citing the exploit's financial impact.
Summer.fi official blog31 August 2026
Planned date for the Summer.fi application and support channels to cease operating.
Summer.fi official blogDecision Log
- hash: DSpaQaaeVSTh3bcm6qZZzFGAupXvDwfiDwENV5XvWhx4
This investigation is cryptographically anchored to the Solana blockchain (1 event). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 7/22/2026, 1:53:55 AM
last updated: 7/27/2026, 5:41:18 PM
4 viewsavoid.net — verified advice for a post-truth world