On May 2025, a single atomic transaction rewrote the ownership of $6 million in DAI. The attacker didn't break into a bank vault. They manipulated a variable.
The victim: Summer.fi, a vault aggregator on Ethereum. The weapon: a flash loan from Morpho. The root cause: a flawed assumption in vault share accounting.
History repeats not by fate, but by flawed code.
Context: The Vault as a Black Box
Summer.fi positions itself as a multi-vault DeFi front end. Users deposit collateral. The platform aggregates positions into strategies powered by underlying protocols like Morpho. Its core function is to track user shares via a calculated ratio: share price = total assets / total shares outstanding. This works until the denominator can be artificially inflated within a single transaction.
The attacker exploited this by taking a $65.4 million flash loan from Morpho. They injected this liquidity into Summer.fi's vault momentarily, altering the vault's total asset figure. The share accounting logic interpreted this inflated state as a new baseline, allowing the attacker to mint shares at a discount. They then withdrew DAI worth $6 million. The transaction was atomic: flash loan, deposit, withdraw, repay—all confirmed in one block.
This is not a reentrancy bug. It is a logical flaw in the state dependency of the share calculation formula.
Core: The On-Chain Evidence Chain
Let me trace the attack using the same method I applied during the Terra collapse forensics in 2022. I reconstructed each step with data from Arkham Intelligence.
The attacker's contract executed four steps:
- Borrow 65.4M DAI via Morpho flash loan.
- Deposit the borrowed DAI into Summer.fi's vault, triggering a share mint.
- Withdraw the maximum possible DAI based on the inflated share value.
- Repay the flash loan with a portion of the extracted funds, leaving $6M profit.
The key metric: the vault's share price before and after the deposit. Before deposit: total_assets = X, shares_outstanding = Y. After deposit: total_assets ≈ X + $65.4M, shares_outstanding = Y + ΔS. The attacker's ΔS was calculated using the pre-deposit share price, but their withdrawal used the post-deposit share price. This temporal mismatch allowed them to extract more than their proportional share.
In mathematical terms: share_price = total_assets / total_shares. The attacker manipulated total_assets, then withdrew at the new, inflated share_price. Simple arithmetic, executed as a single atomic operation.
CertiK and Blockaid flagged the anomaly within hours. The total loss: $6 million, predominantly DAI. The attacker's address holds the stolen assets, unmoved as of this writing.
Based on my 2026 experience auditing AI-agent trading contracts, this class of vulnerability often stems from assuming state changes within a transaction are linear. They are not. A vault share calculation that relies on a snapshot of total assets is vulnerable to flash loan abuse. The code did not enforce the invariant that share price should be time-weighted or oracle-backed.
Contrarian: The Flaw Isn’t the Flash Loan
The contrarian angle: this is not a bug in the code itself—it’s a design flaw in the accounting model. Many will point to the flash loan as the problem. But flash loans are a neutral primitive. The real issue is that Summer.fi's vault share formula lacked a safeguard against temporary liquidity injections.
Correlation is not causation. The $65.4M flash loan size correlates with the $6M profit, but the root cause is the share price dependency on instantaneous total assets. This is not a Morpho risk; it’s a Summer.fi logic risk.
Trust is a variable, not a constant in DeFi. Users trusted that vault share calculations would be robust against single-transaction manipulation. That trust was misplaced. Code is law, but here the law was poorly written.
This attack reveals a broader systemic flaw: many DeFi aggregators assume underlying protocol state is reliable within a transaction. It is not. Atomic composability means anyone can manipulate any state variable, as long as the transaction succeeds.
The forensic reconstruction shows the vulnerability wasn’t in the execution layer but in the accounting layer. The attacker didn’t hack the blockchain; they outsmarted the formula.
Takeaway: The Next Signal
Next week, we will see a wave of protocol audits focusing on vault share calculations. Summer.fi must suspend deposits, deploy a fix using time-weighted or manipulated-state-resistant share pricing, and compensate affected users.
The on-chain data doesn’t care about your feelings. It shows a clear pattern: flash loans + state-dependent accounting = exploit.
The question remains: how many other protocols have the same flaw? The chain is patient. We’ll find out.