Hook
Another DeFi protocol, another flash loan exploit. Summer Finance lost $6 million in a single transaction on June 12, 2026. The attacker borrowed $65 million via flash loan, manipulated Curve’s DAI/USDC pool and Morpho’s liquidity, and exploited a vault accounting flaw. The attack took less than 30 seconds. The damage is done. The question is: why was this vulnerability live on mainnet?
Context
Summer Finance is a yield vault protocol—think automated strategies that deposit user funds into external liquidity pools. It relies heavily on Curve for stablecoin swaps and Morpho for lending market exposure. This integration exposes it to a known risk: price manipulation via flash loans. In a bear market where TVL across DeFi has dropped 40% year-over-year, protocols are fighting for survival. The 2026 Q2 alone saw over $500 million in DeFi hacks. Summer Finance’s loss adds another notch to a grim tally. But this wasn’t a zero-day exploit or a novel cryptographic break. It was a logic error in vault accounting. A mistake that should have been caught during audit.
Core
The attack sequence is textbook but the vulnerability is internal. The attacker initiated a flash loan of $65 million in DAI and USDC from Aave and MakerDAO. Then they swapped a portion of that liquidity on Curve, driving the DAI/USDC pool price off-kilter. This price distortion was used as an input to Summer Finance’s vault contract, which calculated the net asset value of the vault incorrectly. The contract assumed that the value of its deposits in Morpho remained static during the same transaction. It did not. The attacker was able to withdraw more value than they deposited—$6 million worth—and repay the flash loan in full. The entire operation happened in a single block.
The root cause is clear: the vault’s accounting logic did not account for instantaneous price changes in the underlying liquidity pools. It treated the state at the start of the transaction as immutable. This is a classic reentrancy-like flaw, but it’s even simpler. It’s a failure to refresh internal price feeds after external state changes. I’ve seen this pattern before. In 2018, while auditing the 0x protocol, I identified similar reentrancy vulnerabilities where contracts assumed external data wouldn’t change mid-execution. That was eight years ago. The industry has known how to fix this—use a price oracle that snapshots at the start of the transaction, or enforce slippage checks, or use a flash loan resistant design. Summer Finance did none of those.
Contrarian
The common narrative is that this was a sophisticated attack requiring deep understanding of DeFi composability. That’s false. This was a simple accounting oversight. The attacker didn’t need to exploit a bleeding-edge vulnerability. They just needed to read the vault’s code and realize the developer forgot to lock the accounting state. The real contrarian angle is that liquidity fragmentation isn't the problem here—it's the assumption that integrations are safe. VCs love to pitch “composable finance” and “money legos,” but those legos break when one block has a crack. Summer Finance’s reliance on Curve and Morpho isn’t the flaw; the flaw is trusting that those external pools will never be manipulated in the same transaction. Data speaks louder than sentiment: the industry has lost $6 million because a protocol failed to implement a basic security pattern that has been known for years. Critics will blame flash loans, but flash loans are a tool. The real enemy is sloppy accounting.
Takeaway
Liquidity dries up when trust breaks. Users who had funds in Summer Finance should withdraw immediately—if they haven’t already. For the rest of the market, this event reinforces the need to prioritize protocols with proven audit histories and insurance funds. Panic sells, logic buys: the smart money will reallocate to protocols that have survived multiple stress tests. Summer Finance may recover, but its reputation is permanently stained. The question every trader should ask: if a vault can misprice itself in one transaction, what else is wrong under the hood?
