Three exploits this week, $6.3M gone. Most of that total was Summer.fi, where the manipulable value lived in operational state during a strategy offboarding — the kind of thing code analysis alone doesn't own.
But the other two are the ones worth sitting with. Both came down to code trusting a number it shouldn't have: a validation step that quietly did more than validate, a cast that silently changed a value. An assumption that held in the happy path and broke the moment someone pushed on it. Neither is novel, and both are exactly the kind of property you can assert and test before a line reaches mainnet.
Audits check the code someone thought to question. Invariant testing checks the assumptions the code is silently making. That's the whole idea behind Olympix: surface the broken assumption in the dev loop, so it stays a line in a report instead of a headline.
On July 6th, the Summer.fi exploit on Ethereum drained about $6.04M from two Lazy Summer Protocol USDC vaults. The root cause was manipulation of the vault net asset value through the FleetCommander's totalAssets() accounting. During the offboarding of an old strategy, a Silo-based Ark was capped but remained included in the vault's NAV calculation while holding stale-valued Silo vault tokens (Silo: Varlamore USDC Growth).
The attacker accumulated those stale-valued tokens over roughly three months, then in a single atomic transaction funded by a ~$65.4M Morpho flash loan, donated them into the still-counted Ark to inflate totalAssets() and the vault share price, deposited ~$64.8M, and redeemed ~$70.9M, netting ~$6M which was swapped to DAI and sent to the attacker. Key or admin compromise was ruled out by researchers.
Exploit contract: 0x0514F827C129C16418a0933E03C99A6AF982FC61
Exploit Tx: 0x0db528c44f23fc7fa4544684a2fab81096450a14aae8bc89f42cd0592d43da12
On July 13th, the Lumi Finance exploit on Arbitrum drained about $264K from multiple ERC-4337 smart accounts. The root cause was a validation-phase side-effect flaw in Lumi's smart-account logic. In ERC-4337, UserOperation validation must not cause state changes, but Lumi's validation logic let an attacker-controlled paymaster trigger ERC20 approval operations during the validation phase. So merely validating a UserOp granted the attacker allowances from victim smart accounts with no explicit user intent. The attacker then used a sweeper contract to batch-drain the approved tokens across many accounts, primarily LUA and USD₮0, swapped them to ETH, and sent the proceeds out. No user signed these approvals and no key was compromised. The invariant broken is the core ERC-4337 rule that validation is read-only in effect and cannot grant approvals.
Malicious sweeper contract: 0x56362412ae17cac443aafbab4289946ad958e8a1
Exploit txs: 0x020995ec0b5daafe8fab481e33b1b52fdbd6423578060a1f73fd2a9b9fb0ea90, 0x630654fb1c8914405cf81bb02f091b049f19403a152f624f7b8a00c7724c6604
On July 14th, the Drips Network exploit on Ethereum drained 24,882.99 DAI (about $24.9K) from the DaiReserve. The root cause was an unsafe integer cast in DaiDripsHub.give(address,uint128), which converts a uint128 amt to int128 without validating amt <= type(int128).max.
The attacker passed 2^128 - reserveBalance, so the cast produced a negative int128, and negating it yielded a positive value that inverted the transfer direction, turning "user pays the reserve" into "reserve pays the user." A single crafted give() call drained the reserve, with the DAI routed from the DaiReserve through the Hub proxy and the attack contract to the attacker. A near-identical, much smaller instance hit Drips on Polygon 27 minutes later for about 108 DAI.
Victim contract (DaiReserve): 0xf9bbb2df44cfe46e501cf91c99b2f8fef9d9d44a
Exploit tx: 0xc38a6e2259a85ced94238a0b0a49697992f2a6b8140c28f3fd2343d3d8434130