Audit log

Every state-changing event for Summer Finance (Summer.fi): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-17 12:10:17Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   AzP1kYYRunY3…c4imbRgEcopysha256 → base58

   verifying row…

   canonical bytes (23427 B) ▸

   {"actor":"system:backfill","investigation_id":"7e8253f1-08c8-469e-8644-ab5dfced3c12","kind":"publish","page_slug":"summer-finance-summer-fi","published_at":"2026-08-17T12:10:17.624Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Summer Finance (Summer.fi)","sections":[{"content":"Summer Finance originated as OasisDEX, one of the earliest projects built by MakerDAO, providing a frontend interface for the Maker Protocol. The platform evolved into Oasis.app and was spun out as an independent company from the Maker Foundation in June 2021. In June 2023, it rebranded as Summer.fi to signal an expansion beyond its MakerDAO-focused origins into a multi-protocol ecosystem, adding support for Aave, Morpho, Compound, and other protocols. The platform's core product lines included Multiply (leveraged yield), Yield loops, and Vault Automation features. In 2025, Summer.fi launched the Lazy Summer Protocol, an automated yield-optimization vault system that rebalanced depositor capital across lending protocols. The Lazy Summer Protocol accumulated a reported peak total value locked of approximately $200 million during its first nine months of operation, before market deterioration and the July 2026 exploit sharply reduced that figure. The protocol was governed by the Lazy Summer DAO through the SUMR governance token, which began trading on January 21, 2026.","heading":"Background and History","severity":"low","sources":[{"credibility":1,"name":"Sunsetting Summer.fi and the Labs Company — Official Blog","type":"official","url":"https://blog.summer.fi/sunsetting-summer-fi-and-the-labs-company/"},{"credibility":1,"name":"Summer.fi Team Page","type":"official","url":"https://summer.fi/team"},{"credibility":2,"name":"Web3 Is Going Great — Summer Finance Exploit Entry","type":"research","url":"https://www.web3isgoinggreat.com/single/summer-finance-exploit"}]},{"content":"On July 6, 2026, at approximately 05:17 AM UTC, an attacker exploited two Lazy Summer Protocol USDC vaults on Ethereum mainnet — LazyVault_LowerRisk_USDC and LazyVault_HigherRisk_USDC — in a single atomic transaction, extracting approximately $6.04 million in depositor value. The lower-risk vault suffered a loss of approximately $5.64 million and the higher-risk vault approximately $0.40 million.\n\nThe attack used a flash loan of approximately $65.4 million (sourced through Morpho across multiple stablecoins) as supporting liquidity. According to Summer.fi's official post-mortem, the flash loan was not the root vulnerability; rather, it provided temporary liquidity to execute a share-price manipulation that was enabled by a structural flaw in how the protocol handled a partially offboarded strategy adapter (termed an \"Ark\").\n\nThe specific mechanism: a Silo \"Varlamore USDC Growth\" Ark had its deposit cap set to zero during an offboarding procedure following exposure to the November 2025 Stream Finance collapse (see related section), but the Ark was not removed from the vault's net asset value (NAV) calculation. The Silo Varlamore tokens inside that Ark carried stale on-chain valuations and continued accruing interest for approximately eight months despite the underlying assets being impaired. The attacker donated large quantities of these overvalued tokens into the capped, dormant Ark, artificially inflating total reported vault assets by approximately 9.5% without adding genuine withdrawable liquidity. Shares were then redeemed at the inflated price, with the protocol drawing real liquid capital from other depositors' positions to satisfy the redemption. The manipulated Ark itself was sorted last in the withdrawal queue and was never tapped. As a brief visual artifact, the lower-risk vault's displayed APY reportedly read \"2.08 million percent\" for one block — a result of the one-block NAV jump being annualized.\n\nSummer.fi's post-mortem characterized the root cause as \"an operational issue during the offboarding of an old strategy\" and stated that \"the affected contracts behaved as designed.\" The attack required approximately three months of advance preparation, during which the attacker funded multiple wallets beginning around April 6, 2026, and systematically accumulated the stale Silo Varlamore tokens across those addresses. Stolen funds were converted to DAI on Curve before being transferred to the attacker's beneficiary wallet (0x7BF7...BDCa).","heading":"July 6, 2026 Exploit: Lazy Summer USDC Vault Attack","severity":"critical","sources":[{"credibility":1,"name":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","type":"official","url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"},{"credibility":1,"name":"DeFi Protocol Summer.fi Halts Lazy Summer Vaults After $6 Million Exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"credibility":2,"name":"$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/08/6m-lazy-summer-exploit-traces-back-to-novembers-stream-finance-collapse/"},{"credibility":2,"name":"Summer.fi Suffers $6M DeFi Exploit After Alleged Flash Loan Manipulates Vault Accounting — Metaverse Post","type":"news_article","url":"https://mpost.io/summer-fi-suffers-6m-defi-exploit-after-alleged-flash-loan-manipulates-vault-accounting/"},{"credibility":2,"name":"Web3 Is Going Great — Summer Finance Exploit Entry","type":"research","url":"https://www.web3isgoinggreat.com/single/summer-finance-exploit"}]},{"content":"A material precondition for the July 2026 exploit was the November 2025 collapse of Stream Finance. On approximately November 4, 2025, Stream Finance disclosed approximately $93 million in losses after an external fund manager's leveraged ETH positions were liquidated during a price crash. Stream's synthetic dollar token xUSD fell approximately 77% from its $1 peg, triggering an estimated $285 million in interconnected debt across protocols including Euler, Silo, and Morpho. One of the affected parties was the Silo \"Varlamore\" market, which had extended credit to Stream Finance ecosystem participants.\n\nFollowing Stream Finance's collapse, the Silo Varlamore USDC Growth vault tokens held within the Lazy Summer Protocol's corresponding Ark were left carrying a stale on-chain valuation that was never marked down to reflect the underlying impairment. Interest continued to accrue on the stranded USDC for approximately eight months. The Lazy Summer team had zeroed the deposit cap on that Ark during offboarding, but the Ark remained counted in the vault's NAV — a gap that the attacker identified and exploited. The CryptoTimes noted that the root vulnerability can therefore be traced indirectly to the unresolved accounting legacy of the Stream Finance contagion.","heading":"Connection to Stream Finance Collapse (November 2025)","severity":"high","sources":[{"credibility":2,"name":"$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/08/6m-lazy-summer-exploit-traces-back-to-novembers-stream-finance-collapse/"},{"credibility":1,"name":"Stream Finance Stablecoin Plunges 77% After Protocol's Fund Manager Loses $93 Million — Decrypt","type":"news_article","url":"https://decrypt.co/347285/stream-finance-stablecoin-plunges-77-protocol-fund-manager-loses-93-million"},{"credibility":1,"name":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","type":"official","url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"}]},{"content":"At 05:36 AM UTC on July 6, 2026 — approximately 19 minutes after the attack was executed — security firm Blockaid identified the exploit and alerted the Summer.fi team. PeckShield and CertiK also reported suspicious activity. At 06:42 AM UTC, deposit caps on affected vaults were frozen. At 09:48 AM UTC, the protocol publicly contacted the exploiter requesting communication. At 10:25 AM UTC, the Guardian multisig executed pause transactions on Ethereum vaults. At 11:38 AM UTC, vaults on Arbitrum and Sonic were paused. At 16:39 PM UTC, the Foundation swept malicious token positions. At 17:16 PM UTC, the investigation team contacted exchange FixedFloat regarding the exploiter's funding sources. A pause on HyperEVM vaults failed due to the guardian role not having been assigned on that network.\n\nThe Summer.fi team coordinated with SEAL 911, Blockaid, CertiK, and PeckShield on forensic analysis. Law enforcement contacts were engaged for fund tracing. The protocol publicly identified the beneficiary wallet (0x7BF7...BDCa) and executor contract (0x0514...FC61) to enable community and exchange monitoring.","heading":"Incident Response","severity":"medium","sources":[{"credibility":1,"name":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","type":"official","url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"},{"credibility":1,"name":"DeFi Protocol Summer.fi Halts Lazy Summer Vaults After $6 Million Exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"}]},{"content":"Following the exploit, the attacker began moving stolen funds through the sanctioned cryptocurrency mixer Tornado Cash. According to Summer.fi's post-mortem, the attacker swapped approximately $1.35 million in DAI to ETH via Uniswap, routed the ETH through an intermediary wallet (0x46e0...eBa7), and deposited it into Tornado Cash. As of the post-mortem publication, approximately $4.67 million in DAI remained in the exploiter's primary wallet, with approximately $50 ETH in the intermediary wallet. Summer.fi stated that the attacker's use of a mixer indicated \"limited intent to return the funds voluntarily\" and that tracking \"breaks down\" once assets enter mixer infrastructure. The approximately $4 million in user assets tied to the two exploited USDC vaults remained temporarily illiquid, with recovery contingent on DAO governance decisions. By July 30, 2026, unaffected vaults were reopened for withdrawals via a Merkl distribution mechanism, with deposit caps remaining at zero and fees set to zero on remaining balances.","heading":"Fund Recovery and Attacker Laundering Activity","severity":"high","sources":[{"credibility":2,"name":"Summer.fi Hacker Moves $1.35M Into Tornado Cash — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33126491/"},{"credibility":1,"name":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","type":"official","url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"},{"credibility":1,"name":"All Lazy Summer Vaults Are Now Available for Withdrawal — Summer.fi Blog","type":"official","url":"https://blog.summer.fi/all-lazy-summer-vaults-are-now-available-for-withdrawal/"}]},{"content":"Following public disclosure of the exploit on July 6, 2026, the SUMR governance token fell more than 18% in price. The protocol's total value locked at the time of the exploit was reported at approximately $22 million by DeFiLlama, a significant decline from the reported peak of approximately $200 million during the Lazy Summer Protocol's first nine months of operation. All Lazy Summer Protocol vaults across Ethereum, Base, Arbitrum, Sonic, and HyperEVM were paused following the incident.","heading":"Market Impact: SUMR Token and TVL","severity":"high","sources":[{"credibility":1,"name":"DeFi Protocol Summer.fi Halts Lazy Summer Vaults After $6 Million Exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"credibility":2,"name":"Summer.fi Exploit $6 Million SUMR — BeInCrypto","type":"news_article","url":"https://beincrypto.com/summer-fi-exploit-6-million-sumr/"}]},{"content":"On July 15, 2026, Summer.fi announced it would cease operations, stating it had \"no viable path forward other than to wind down operations.\" The company cited two compounding factors: the financial losses suffered by depositors, and the fact that \"a meaningful portion of the team's own capital was held in the affected vaults, removing the runway we needed to rebuild.\" The Summer.fi application remained operational through August 31, 2026, with email and Discord support available through the same date.\n\nThe Lazy Summer Protocol itself does not wind down with the company: vault contracts remain on-chain and permissionless under Lazy Summer DAO governance, with shares redeemable via direct ERC-4626 contract interactions independent of the Summer.fi frontend. The company stated that user access to funds does not end on August 31, 2026. Non-exploited vaults were reopened for withdrawals on July 30, 2026. Affected USDC vault depositors were directed to claim distributions via the Merkl distribution platform.\n\nThe protocol's history spans approximately five years from its spinout from the Maker Foundation in June 2021 to its wind-down announcement in July 2026.","heading":"Company Wind-Down","severity":"critical","sources":[{"credibility":1,"name":"Sunsetting Summer.fi and the Labs Company — Official Blog","type":"official","url":"https://blog.summer.fi/sunsetting-summer-fi-and-the-labs-company/"},{"credibility":2,"name":"Summer.fi Confirms Shutdown Following Major USDC Vault Exploit — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/summer-fi-confirms-shutdown-following-exploit/"},{"credibility":1,"name":"All Lazy Summer Vaults Are Now Available for Withdrawal — Summer.fi Blog","type":"official","url":"https://blog.summer.fi/all-lazy-summer-vaults-are-now-available-for-withdrawal/"},{"credibility":2,"name":"Web3 Is Going Great — Summer Finance Exploit Entry","type":"research","url":"https://www.web3isgoinggreat.com/single/summer-finance-exploit"}]},{"content":"The Summer.fi exploit was reported in the context of broader DeFi security conditions in 2026. Multiple sources noted that DeFi sector losses in 2026 had exceeded $840 million at the time of the incident. Security researchers identified the share-accounting vulnerability used in this exploit — specifically the pattern of impaired strategy adapters remaining counted in NAV calculations after deposit-cap offboarding — as potentially relevant to other yield-optimization protocols using similar vault architectures. The AMBCrypto report noted the months-long preparation period (approximately three months) as notable, contrasting with more opportunistic flash-loan attacks.","heading":"Broader DeFi Context","severity":"medium","sources":[{"credibility":2,"name":"Summer.fi Reveals Months-Long Preparation Behind $6M DeFi Exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/summer-fi-reveals-months-long-preparation-behind-6m-defi-exploit/"},{"credibility":2,"name":"Summer Finance Exploited for $6 Million, Shuts Down — Web3 Is Going Great","type":"research","url":"https://www.web3isgoinggreat.com/single/summer-finance-exploit"}]}],"sources_used":[{"credibility":1,"name":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","type":"official","url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"},{"credibility":1,"name":"Sunsetting Summer.fi and the Labs Company — Official Blog","type":"official","url":"https://blog.summer.fi/sunsetting-summer-fi-and-the-labs-company/"},{"credibility":1,"name":"All Lazy Summer Vaults Are Now Available for Withdrawal — Summer.fi Blog","type":"official","url":"https://blog.summer.fi/all-lazy-summer-vaults-are-now-available-for-withdrawal/"},{"credibility":1,"name":"DeFi Protocol Summer.fi Halts Lazy Summer Vaults After $6 Million Exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"credibility":1,"name":"Stream Finance Stablecoin Plunges 77% After Protocol's Fund Manager Loses $93 Million — Decrypt","type":"news_article","url":"https://decrypt.co/347285/stream-finance-stablecoin-plunges-77-protocol-fund-manager-loses-93-million"},{"credibility":2,"name":"$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/08/6m-lazy-summer-exploit-traces-back-to-novembers-stream-finance-collapse/"},{"credibility":2,"name":"Summer.fi Reveals Months-Long Preparation Behind $6M DeFi Exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/summer-fi-reveals-months-long-preparation-behind-6m-defi-exploit/"},{"credibility":2,"name":"Summer.fi Hacker Moves $1.35M Into Tornado Cash — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33126491/"},{"credibility":2,"name":"Summer.fi Confirms Shutdown Following Major USDC Vault Exploit — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/summer-fi-confirms-shutdown-following-exploit/"},{"credibility":2,"name":"Summer.fi Suffers $6M DeFi Exploit After Alleged Flash Loan Manipulates Vault Accounting — Metaverse Post","type":"news_article","url":"https://mpost.io/summer-fi-suffers-6m-defi-exploit-after-alleged-flash-loan-manipulates-vault-accounting/"},{"credibility":2,"name":"Summer.fi Exploit $6 Million SUMR — BeInCrypto","type":"news_article","url":"https://beincrypto.com/summer-fi-exploit-6-million-sumr/"},{"credibility":2,"name":"Summer Finance Exploited for $6 Million, Shuts Down — Web3 Is Going Great","type":"research","url":"https://www.web3isgoinggreat.com/single/summer-finance-exploit"},{"credibility":2,"name":"Summer.fi Winds Down After $6M Lazy Summer Vault Exploit — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/summer-fi-winds-down-after-6m-lazy-summer-vault-exploit/"}],"summary":"Summer Finance, operating as Summer.fi, was a DeFi yield-optimization protocol that spun out of the Maker Foundation in 2021 and rebranded from Oasis.app in June 2023. On July 6, 2026, its Lazy Summer Protocol was exploited for approximately $6.04 million through a share-price manipulation attack that leveraged stale-valued tokens left over from the November 2025 collapse of Stream Finance. Following the exploit, the company announced it would cease operations, with the Summer.fi application shutting down on August 31, 2026, and governance of remaining vault infrastructure transitioning to the Lazy Summer DAO.","timeline":[{"date":"2021-06-01","event":"Summer Finance (then Oasis.app) spun out from the Maker Foundation as an independent company.","source":"Sunsetting Summer.fi and the Labs Company — Official Blog","source_url":"https://blog.summer.fi/sunsetting-summer-fi-and-the-labs-company/"},{"date":"2023-06-01","event":"Oasis.app rebranded as Summer.fi to reflect expansion beyond the MakerDAO ecosystem.","source":"Summer.fi Team Page","source_url":"https://summer.fi/team"},{"date":"2025-11-04","event":"Stream Finance disclosed approximately $93 million in losses; xUSD stablecoin fell approximately 77%, leaving Silo Varlamore USDC Growth vault tokens with stale on-chain valuations that were never corrected.","source":"Stream Finance Stablecoin Plunges 77% — Decrypt","source_url":"https://decrypt.co/347285/stream-finance-stablecoin-plunges-77-protocol-fund-manager-loses-93-million"},{"date":"2025-12-10","event":"Lazy Summer Protocol launched SUMR Staking V2, enabling SUMR holders to earn staking rewards and USDC revenue distributions.","source":"SUMR Staking V2 Blog Post — Summer.fi","source_url":"https://blog.summer.fi/introducing-sumr-staking-v2-all-you-need-to-know-about-defis-most-productive-asset/"},{"date":"2026-01-21","event":"SUMR governance token began trading for the first time.","source":"Lazy Summer Governance Recap January 2026 — Summer.fi Blog","source_url":"https://blog.summer.fi/lazy-summer-governance-recap-january-2026/"},{"date":"2026-04-06","event":"Attacker funded multiple wallets from identical sources, beginning a three-month accumulation phase targeting stale Silo Varlamore USDC Growth tokens.","source":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","source_url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"},{"date":"2026-07-06","event":"At 05:17 AM UTC, attacker executed a single atomic transaction exploiting the Lazy Summer USDC vaults, extracting approximately $6.04 million in depositor value via share-price manipulation using stale Silo Varlamore tokens and a ~$65.4 million flash loan.","source":"Lazy Summer USDC Vault Exploit Post-Mortem — Summer.fi Official Blog","source_url":"https://blog.summer.fi/lazy-summer-usdc-vault-exploit-post-mortem-what-happened-and-what-comes-next/"},{"date":"2026-07-06","event":"At 05:36 AM UTC, Blockaid identified the exploit and alerted the team. Guardian multisig progressively paused vaults across Ethereum, Base, Arbitrum, and Sonic through 11:38 AM UTC.","source":"DeFi Protocol Summer.fi Halts Lazy Summer Vaults — CoinDesk","source_url":"https://www.coindesk.com/web3/2026/07/06/defi-protocol-summer-fi-halts-lazy-summer-vaults-after-usd6-million-exploit"},{"date":"2026-07-06","event":"SUMR governance token fell more than 18% following public disclosure of the exploit.","source":"Summer.fi Exploit $6 Million SUMR — BeInCrypto","source_url":"https://beincrypto.com/summer-fi-exploit-6-million-sumr/"},{"date":"2026-07-08","event":"Reporting established the causal link between the November 2025 Stream Finance collapse and the stale Silo token valuations that enabled the July 6 exploit.","source":"$6M Lazy Summer Exploit Traces Back to November's Stream Finance Collapse — CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/08/6m-lazy-summer-exploit-traces-back-to-novembers-stream-finance-collapse/"},{"date":"2026-07-15","event":"Summer.fi announced wind-down of operations, stating it had no viable path forward after the exploit eliminated team capital and protocol runway. Application set to shut down August 31, 2026.","source":"Sunsetting Summer.fi and the Labs Company — Official Blog","source_url":"https://blog.summer.fi/sunsetting-summer-fi-and-the-labs-company/"},{"date":"2026-07-30","event":"Thirteen non-exploited Lazy Summer vaults across Ethereum, Base, Arbitrum, Sonic, and HyperEVM reopened for withdrawals. Deposit caps remain at zero; affected USDC vault users directed to claim via Merkl distribution.","source":"All Lazy Summer Vaults Are Now Available for Withdrawal — Summer.fi Blog","source_url":"https://blog.summer.fi/all-lazy-summer-vaults-are-now-available-for-withdrawal/"},{"date":"2026-08-31","event":"Summer.fi application and support channels scheduled to cease operations. Protocol vault contracts remain on-chain under Lazy Summer DAO governance.","source":"Sunsetting Summer.fi and the Labs Company — Official Blog","source_url":"https://blog.summer.fi/sunsetting-summer-fi-and-the-labs-company/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 60142041-39b0-4210-8eba-16090c628875copy