PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Becoming a millionaire, 0.000150 BTC at a time

osec.io | blog | #defi | #vulnerability | #solana | #rounding | #spl-token-swap | #arbitrage
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec found a rounding issue in the Solana Program Library's stable swap, letting attackers extract one token per instruction across pools worth over $700M in combined value.
Published
Collected

Related coverage

blog · osec.io
Rounding bugs: an analysis
OtterSec analyzes share-rounding attacks on lending protocols: why flash loans are irrelevant, the two-step recipe (inflate share value, exploit rounding), and mitigations.
blog · osec.io
The story of the curious rent thief
OtterSec investigates a bot stealing rent from uninitialized Solana accounts, via a case study of an attack on Solend's permissionless pools exploiting the creation-initialization gap.
blog · osec.io
The $200m bluff: cheating oracles on Solana
OtterSec shows how Switchboard liquidity pool token price feeds could be manipulated, risking up to $200M across Solana lending protocols — and explains fair LP token pricing.
incident · certik.com
DefiTuna Incident Analysis
On 16 July 2026, DeFiTuna on Solana lost $569,601 USDC: attackers routed borrowed USDC through an illiquid TUNA/USDC pool, rounding the position's assets to zero and bypassing the solvency check.
blog · osec.io
Auto reverse-engineering the Hyperliquid risk engine, with some agentic help
OtterSec reverse-engineers Hyperliquid's closed-source risk engine (Rust), showing how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma, aided by agentic tooling.
blog · osec.io
Solana: the hidden dangers of lamport transfers
OtterSec dissects a simple Solana game to expose lamport transfer pitfalls — rent-exemption traps and write-demotion — that can silently fail transfers, brick programs, or crown an eternal king.
Back