How much was lost in the Cashio hack?

The Cashio hack resulted in $48.0M in losses on March 23, 2022.

What attack technique was used in the Cashio exploit?

The Cashio exploit utilized Collateral Validation Exploit / Other. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Cashio Hack

TOTAL LOST $48.0M

High #130 All-Time Mar 23, 2022 Collateral Validation Exploit / Other solana

Affected Chain solana Incident surface

Recovered - No recovery reported

All-Time Rank #130 By amount stolen

Protocol Type CDP Target category

Incident Overview

Quick Summary

Cashio protocol was exploited due to incorrect collateral validation during minting, which has led to infinite minting.

Details of the Exploit

The validation of the LP tokens is to be deposited via the saber_swap.arrow (USDT-USDC LP) is incomplete, as the mint field is never validated. As a consequence, the hacker was able to deploy a bogus contract that was never verified, followed by a chain of bogus accounts that all passed validation since they were only compared to one another.

In addition, in order to pass the common collateral verification, the hacker created a fake bank and was able to instruct the program to mint the original $CASH token because there was no check that the bank's token matched the one being minted.

After these actions, the hacker minted 2 billion $CASH tokens, and the part of $CASH was burnt to SaberLPTokens. Then another part of the tokens was withdrawn out to $UST and $USDC. The remaining $CASH was swapped for 8,600,000 $UST and 17,000,000 $USDC. Most of the stolen funds were bridged to Ethereum address.

The hacker left the message in the transaction "Account with less than 100k have been returned. All other money will be donated to charity."

Block Data Reference

The hacker's address:

https://solscan.io/account/6D7fgzpPZX…hnVuzw

Validation transaction:

https://solscan.io/tx/3t1zqtKk4C…Y2Z39y

Mint transaction:

https://solscan.io/tx/2X1TKidhbo…P6H5tP

Burning to SaberLPTokens transaction:

https://solscan.io/tx/4g5okypEDK…9QrUvV

Withdraw transaction:

https://solscan.io/tx/pjUgAeUfWa…vbsrwH

Ethereum address funds were sent:

https://etherscan.io/address/0x86766247ba3405c5f15f06b895294200809e9cfb

The message hacker left:

https://etherscan.io/tx/0xa8394d2e55042f84d096c72dd1075fa2648faf88e248c7992273b4d50a6a647b

Incident Report

Protocol / Project Cashio

Date of Incident March 23, 2022

Affected Chain(s) solana

Attack Technique Collateral Validation Exploit / Other

Classification Protocol Logic / Stablecoin

Primary Source View Post-Mortem

Protocol Information

Protocol Type CDP

Affected Token CASH

Smart Contract Language Rust

Official Website cashio.app/

Protocol Twitter/X @CashioApp

Team Anonymous

Source Code Unverified

Market Context at Time of Hack

Protocol Links

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of collateral validation exploit / other and Rust/Anchor program internals and the Solana account model

Capital Required Seed capital to cover Solana network fees and initial position setup

On-Chain Access Ability to interact with solana Solana programs and deploy a custom exploit program or signer account

Protocol Analysis Identification of the exploitable vulnerability in Cashio's program logic - root cause: protocol logic / stablecoin

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single Solana transaction (atomic across instructions)

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough Collateral Validation Exploit / Other audit checklist and test coverage

If you're auditing a protocol with similar architecture to Cashio, these are the critical security checks that could have prevented this incident (March 2022).

Verify all logic paths related to Collateral Validation Exploit / Other are guarded by proper access controls and input validation
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Sources & References

01
Source 1 https://twitter.com/samczsun/status/1506578902331768832?s=20&t=U…
02
Reference https://twitter.com/CashioApp/status/1506571243067224064
03
Reference https://twitter.com/samczsun/status/1507056110934511619?s=28

Threat Assessment

Severity Level

HIGH

Attack Vector Collateral Validation Exploit / Other
Root Cause Protocol Logic / Stablecoin
Year 2022

Learn to Prevent the Next Cashio

The Cashio hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library