Cashio Hack
Reported loss
$52.8M
Unauthorized minting through unvalidated account inputs
What happened
On March 23, 2022, Cashio's Solana stablecoin minting program was exploited after it accepted attacker-created account data as valid collateral configuration. The attacker minted billions of unbacked CASH and drained the collateral backing the system, with reports placing the loss at about $52.8 million.
Technical root cause
The Brrr minting program failed to verify that the supplied Bank account and collateral configuration were the protocol's authorized program-derived accounts. That let a caller substitute fake accounts and satisfy local consistency checks without depositing real collateral.
How it happened
- Cashio's print_cash instruction received a Bank account, collateral account, and Saber-related accounts supplied by the caller.
- The program checked only their relationship to one another, not that they belonged to Cashio's authorized configuration.
- The attacker created matching fake accounts, passed them into the minting instruction, minted unbacked CASH, then redeemed and sold it against genuine collateral.
Protocol details
Classification
Stablecoin minting / account validation failure
Protocol Type
CDP
Affected asset / contract
CASH
Implementation language
Rust
Protocol links
Website
@CashioApp
Evidence
- report @samczsun incident report twitter.com
- report @CashioApp incident report twitter.com
- report @samczsun incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis Revisiting the CashioApp Security Incident blocksec.com
- analysis Stablecoin Cashio on Solana exploited for $52.8 million in infinite mint glitch theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
