toad

Update: Priority loan functionality has now been restored across the platform. • Collateral-top ups are available for all loans • Repayments are available for all loans except those funded by the USDC Genesis Vault • Borrowers who fully repay loans can withdraw their collateral. Collateral withdrawals remain temporarily disabled for loans funded by the USDC Genesis Vault. Vault withdrawals and all other protocol functionality remain restricted out of an abundance of caution. Our team and partners are working to ensure a safe restoration of full functionality as quickly as possible. We have identified and contained the two paths used during this incident. Both paths involved sophisticated, multi-step transactions targeting publicly inspectable program logic and private transaction-building APIs. The attacker first targeted the SOL Genesis Vault using a misconfigured combination of asset-pricing parameters that caused deposited collateral to be valued as a different asset, enabling an undercollateralized loan of approximately $412K. They later used an atomic transaction bundle to sell a loan carrying an extreme interest rate into the USDC Genesis Vault, inflating its NAV and enabling a disproportionate redemption of approximately $521K which our systems halted within 30 seconds of transaction generation. No user deposits will incur a loss. We will share further updates from this account as our investigation progresses and additional functionality is safely restored.