Audit log

Every state-changing event for Summer Finance (Lazy Summer Protocol): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-27 12:08:03Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 450,992,608

   sig

   5yYqQsaBHEvT…B3Qc73pQcopyexplorer ↗

   hash

   FJEopQu1c97J…TqykvfnMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14204 B) ▸

   {"actor":"system:backfill","investigation_id":"00c515db-8f83-47b3-be6d-f3ee4368843d","kind":"publish","page_slug":"summer-finance-lazy-summer-protocol","published_at":"2026-09-27T12:08:02.930Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Summer Finance (Lazy Summer Protocol)","sections":[{"content":"Summer.fi was founded in 2016 as Oasis.app, originally built within the Maker Foundation as the official front-end interface for the MakerDAO protocol, and was spun out as an independent entity in 2021 following MakerDAO's decentralization. In June 2023, Oasis.app rebranded to Summer.fi to reflect an expansion beyond its Maker-only roots into a multi-protocol DeFi interface supporting Aave, Compound, Morpho, and Spark, among others. The company is led by CEO Chris Bradbury, a former MakerDAO/Oasis product manager. In 2025, Summer.fi launched the Lazy Summer Protocol, an AI-keeper-managed yield-optimization system with its own governance token, SUMR, which began trading around late January 2025. The Lazy Summer Protocol became Summer.fi's primary product, with the earlier 'Summer.fi Pro' borrow/leverage product later transitioned to a third party, DeFi Saver.","heading":"Identity and Rebrand History","severity":"low","sources":[{"credibility":2,"name":"Oasis.app Rebrands To Summer.fi (Summer.fi blog)","type":"official","url":"https://blog.summer.fi/oasis-app-rebrands-to-summer-fi/"},{"credibility":2,"name":"Chris Bradbury - CEO @ Summer.fi at Oasis.app | The Org","type":"other","url":"https://theorg.com/org/oasis-app/org-chart/chris-bradbury"},{"credibility":2,"name":"Summer.fi goes all in on Lazy Summer Protocol as Summer.fi Pro transitions to DeFi Saver","type":"official","url":"https://blog.summer.fi/summer-fi-goes-all-in-on-lazy-summer-protocol-as-summer-pro-transitions-to-defi-saver/"},{"credibility":2,"name":"Lazy Summer Protocol Launches With an AI-Powered Yield Optimizer for DeFi | The Defiant","type":"news_article","url":"https://thedefiant.io/news/press-releases/lazy-summer-protocol-launches-with-an-ai-powered-yield-optimizer-for-defi"}]},{"content":"On July 6, 2026, blockchain security monitors including Blockaid, PeckShield, Cyvers, and CertiK flagged a live exploit against the Lazy Summer Protocol's USDC vaults on Ethereum. According to reporting from CoinDesk and The Block, an attacker used a flash loan of roughly $65.4 million (sourced via Morpho) to manipulate the net-asset-value accounting used by the protocol's 'FleetCommander' vault-routing logic across its underlying 'Ark' sub-vaults, inflating total assets and enabling a redemption of approximately $70.9 million against the deposit, for a net theft of approximately $6 million (one report cites $6.04 million). Analysts noted the exploit involved depositing into a Silo market vault that had reportedly been halted following a separate incident in November 2025. Stolen funds were converted to DAI via Curve before being moved onward; some reporting states funds were later routed toward Tornado Cash. Summer.fi's protocol guardians paused the affected vaults and set deposit limits to zero to prevent further losses; the SUMR token fell over 18% following disclosure of the exploit. Total value locked in the protocol was reported at approximately $22 million immediately prior to the attack.","heading":"July 2026 Flash-Loan Exploit of Lazy Summer USDC Vaults","severity":"critical","sources":[{"credibility":1,"name":"DeFi protocol Summer.fi halts Lazy Summer vaults after $6 million exploit (CoinDesk)","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"credibility":1,"name":"DeFi protocol Summer Finance exploited for $6 million; analysts point to flash loan attack (The Block)","type":"news_article","url":"https://www.theblock.co/post/407198/summer-finance-exploited"},{"credibility":2,"name":"Summer.fi Hacked: $6M Stolen as Funds Vanish Into Tornado Cash (MEXC News)","type":"news_article","url":"https://www.mexc.com/news/1198957"},{"credibility":2,"name":"Summer.fi $6M Exploit Freezes Lazy Summer Vaults | SUMR Falls 18% (Phemex Academy)","type":"news_article","url":"https://phemex.com/academy/summerfi-exploit-freezes-lazy-summer-vaults"},{"credibility":2,"name":"Just-In: Summer.fi Hit By Suspected $6M Flash Loan Exploit As DeFi Vaults Targeted (CoinGape)","type":"news_article","url":"https://coingape.com/summer-fi-hit-by-suspected-6m-flash-loan-exploit-as-defi-vaults-targeted/"}]},{"content":"Following the exploit, Summer.fi announced it would wind down the company, stating the losses left it 'without enough financial runway to fund recovery work, infrastructure and continued operations,' and noting that a meaningful portion of team capital had itself been held in the affected vaults, compounding the shortfall. The Summer.fi web application was slated to continue operating only until August 31, 2026, after which responsibility for the protocol and any recovery process passes entirely to the Lazy Summer DAO. Reporting explicitly states that, as of the wind-down announcement, 'the team has not guaranteed full compensation for affected depositors,' and that any recovery plan or reimbursement depends on future DAO governance decisions with no established timeline. The Lazy Summer DAO subsequently worked to restore withdrawal and redemption functionality to unaffected and affected vaults on a rolling basis.","heading":"Company Wind-Down and Uncertain Depositor Compensation","severity":"critical","sources":[{"credibility":2,"name":"Summer.fi to Wind Down After $6.04 Million Vault Exploit (Cryip)","type":"news_article","url":"https://cryip.co/summer-fi-to-wind-down-after-6-04-million-vault-exploit/"},{"credibility":2,"name":"$6 Million Vault Exploit Forces DeFi Platform Summer.fi to Wind Down (BeInCrypto)","type":"news_article","url":"https://beincrypto.com/summer-fi-shutdown-lazy-summer-exploit/"},{"credibility":2,"name":"Summer.fi shuts down due to the July 6th hack, application will operate until August 31st (Bitget News)","type":"news_article","url":"https://www.bitget.com/news/detail/12560605506785"},{"credibility":2,"name":"Summer.fi shuts down after exploit – Lazy Summer DAO to resume withdrawals (Bitget News)","type":"news_article","url":"https://www.bitget.com/news/detail/12560605509769"},{"credibility":2,"name":"All Lazy Summer Vaults are now available for withdrawal (Summer.fi blog)","type":"official","url":"https://blog.summer.fi/all-lazy-summer-vaults-are-now-available-for-withdrawal/"}]},{"content":"Prior to the July 2026 exploit, Summer.fi (as Oasis.app and later Summer.fi) had operated since 2016 as a widely used front-end for major, separately audited DeFi lending protocols (MakerDAO, Aave, Compound, Spark) and was described by industry commentary as one of the larger DeFi-adjacent platforms by usage. Summer.fi's own documentation states it maintains a list of smart contract audits and applies a tier-based system incorporating security-firm assessments (including CertiK) to rank the reliability of assets and integrated markets used by the Lazy Summer Protocol. No prior fraud, exit-scam, or regulatory-enforcement allegations against Summer.fi/Oasis.app were identified in available reporting; the entity's primary verified negative event is the July 2026 exploit and subsequent wind-down. This assessment reflects publicly available sources found at the time of writing and may not capture all incidents.","heading":"Prior Standing and Security Posture","severity":"medium","sources":[{"credibility":2,"name":"Audits | Summer.fi Knowledge Base","type":"official","url":"https://docs.summer.fi/summer.fi/audits"},{"credibility":2,"name":"Becoming the Front Page of Finance: The Summer.fi Vision (The Defiant)","type":"news_article","url":"https://thedefiant.io/becoming-the-front-page-of-finance-the-summer-fi-vision"}]}],"sources_used":[{"credibility":1,"name":"DeFi protocol Summer.fi halts Lazy Summer vaults after $6 million exploit (CoinDesk)","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"credibility":1,"name":"DeFi protocol Summer Finance exploited for $6 million; analysts point to flash loan attack (The Block)","type":"news_article","url":"https://www.theblock.co/post/407198/summer-finance-exploited"},{"credibility":2,"name":"Summer.fi Hacked: $6M Stolen as Funds Vanish Into Tornado Cash (MEXC News)","type":"news_article","url":"https://www.mexc.com/news/1198957"},{"credibility":2,"name":"Summer.fi $6M Exploit Freezes Lazy Summer Vaults | SUMR Falls 18% (Phemex Academy)","type":"news_article","url":"https://phemex.com/academy/summerfi-exploit-freezes-lazy-summer-vaults"},{"credibility":2,"name":"Just-In: Summer.fi Hit By Suspected $6M Flash Loan Exploit As DeFi Vaults Targeted (CoinGape)","type":"news_article","url":"https://coingape.com/summer-fi-hit-by-suspected-6m-flash-loan-exploit-as-defi-vaults-targeted/"},{"credibility":2,"name":"Summer.fi to Wind Down After $6.04 Million Vault Exploit (Cryip)","type":"news_article","url":"https://cryip.co/summer-fi-to-wind-down-after-6-04-million-vault-exploit/"},{"credibility":2,"name":"$6 Million Vault Exploit Forces DeFi Platform Summer.fi to Wind Down (BeInCrypto)","type":"news_article","url":"https://beincrypto.com/summer-fi-shutdown-lazy-summer-exploit/"},{"credibility":2,"name":"Summer.fi shuts down due to the July 6th hack, application will operate until August 31st (Bitget News)","type":"news_article","url":"https://www.bitget.com/news/detail/12560605506785"},{"credibility":2,"name":"Summer.fi shuts down after exploit – Lazy Summer DAO to resume withdrawals (Bitget News)","type":"news_article","url":"https://www.bitget.com/news/detail/12560605509769"},{"credibility":2,"name":"All Lazy Summer Vaults are now available for withdrawal (Summer.fi blog)","type":"official","url":"https://blog.summer.fi/all-lazy-summer-vaults-are-now-available-for-withdrawal/"},{"credibility":2,"name":"Oasis.app Rebrands To Summer.fi (Summer.fi blog)","type":"official","url":"https://blog.summer.fi/oasis-app-rebrands-to-summer-fi/"},{"credibility":2,"name":"Chris Bradbury - CEO @ Summer.fi at Oasis.app | The Org","type":"other","url":"https://theorg.com/org/oasis-app/org-chart/chris-bradbury"},{"credibility":2,"name":"Summer.fi goes all in on Lazy Summer Protocol as Summer.fi Pro transitions to DeFi Saver","type":"official","url":"https://blog.summer.fi/summer-fi-goes-all-in-on-lazy-summer-protocol-as-summer-pro-transitions-to-defi-saver/"},{"credibility":2,"name":"Lazy Summer Protocol Launches With an AI-Powered Yield Optimizer for DeFi | The Defiant","type":"news_article","url":"https://thedefiant.io/news/press-releases/lazy-summer-protocol-launches-with-an-ai-powered-yield-optimizer-for-defi"},{"credibility":2,"name":"Audits | Summer.fi Knowledge Base","type":"official","url":"https://docs.summer.fi/summer.fi/audits"},{"credibility":2,"name":"Becoming the Front Page of Finance: The Summer.fi Vision (The Defiant)","type":"news_article","url":"https://thedefiant.io/becoming-the-front-page-of-finance-the-summer-fi-vision"}],"summary":"Summer.fi is a DeFi lending and yield front-end originally launched in 2016 as Oasis.app, the official interface for MakerDAO, before rebranding to Summer.fi in 2023 and later launching an AI-keeper-driven yield optimizer called the Lazy Summer Protocol (token: SUMR). On July 6, 2026, Lazy Summer's USDC vaults were drained of approximately $6 million via a flash-loan attack that manipulated the protocol's vault accounting logic; Summer.fi subsequently paused all vaults, has not guaranteed full reimbursement to depositors, and announced it is winding down the company, transferring control to the Lazy Summer DAO with the app scheduled to stop operating on August 31, 2026.","timeline":[{"date":"2016","event":"Oasis.app founded/launched within the Maker Foundation as the official front-end interface for MakerDAO.","source":"The Org / Chris Bradbury profile","source_url":"https://theorg.com/org/oasis-app/org-chart/chris-bradbury"},{"date":"2021","event":"Oasis.app spun out as an independent entity following the decentralization of the Maker Foundation.","source":"The Org / Chris Bradbury profile","source_url":"https://theorg.com/org/oasis-app/org-chart/chris-bradbury"},{"date":"2023-06","event":"Oasis.app rebrands to Summer.fi, expanding beyond MakerDAO to a multi-protocol DeFi interface.","source":"Summer.fi blog","source_url":"https://blog.summer.fi/oasis-app-rebrands-to-summer-fi/"},{"date":"2025-01","event":"SUMR governance token for the newly launched Lazy Summer Protocol begins trading.","source":"Web search summary of Lazy Summer Protocol launch coverage","source_url":"https://thedefiant.io/news/press-releases/lazy-summer-protocol-launches-with-an-ai-powered-yield-optimizer-for-defi"},{"date":"2026-07-06","date_evidence":"occurred on July 6, 2026","event":"Attacker uses a roughly $65.4 million flash loan to manipulate Lazy Summer Protocol vault accounting, draining approximately $6 million from USDC vaults; Blockaid, PeckShield, Cyvers and CertiK flag the exploit and Summer.fi pauses affected vaults.","source":"CoinDesk","source_url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"date":"2026-07","event":"Summer.fi announces it will wind down the company, citing insufficient financial runway after the exploit; app to remain operative only until August 31, 2026, with governance handed to the Lazy Summer DAO. Full depositor compensation is not guaranteed.","source":"Cryip / BeInCrypto coverage","source_url":"https://cryip.co/summer-fi-to-wind-down-after-6-04-million-vault-exploit/"},{"date":"2026-08","date_original":"2026-08-31","event":"Planned end date for Summer.fi interface/support operations, after which the Lazy Summer DAO assumes full responsibility for the protocol and any remaining recovery process.","source":"Cryip","source_url":"https://cryip.co/summer-fi-to-wind-down-after-6-04-million-vault-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2282a0bf-3c93-4563-b08f-ca214b66ad1bcopy