Summer.fi: Lazy Summer Protocol USDC Vault Hack Abused NAV Accounting, Not a Smart-Contract Bug

Summer.fi published a post-mortem on the exploit affecting the Lazy Summer Protocol's USDC vaults, where an attacker extracted about $6.04 million from depositors. According to the analysis, the attacker orchestrated an atomic transaction to manipulate share prices across two USDC vaults. The key weakness was the vault's net asset value (NAV) calculation. By donating tokens carrying stale valuations into a Silo Ark that had been paused since the November 2025 incident but not fully removed, the attacker artificially boosted the vault's reported total assets by roughly 9.5%, pushing share prices higher. The attacker then redeemed shares at the inflated price and withdrew funds backed by the vault's real liquidity. Summer.fi said the incident did not stem from a smart contract vulnerability. Instead, it exposed a flaw in the vault deactivation process: while the Ark's deposit limit had been set to zero, its assets were still counted in NAV. The report adds that the attacker prepared for roughly three months, gathering the required tokens across multiple wallets, and later routed part of the proceeds through Tornado Cash. In response, the Guardian Multisig has paused all onchain vaults and set deposit limits to zero. The Lazy Summer DAO is expected to discuss user compensation and proposals to restore vault operations in the coming days.