What happened
On August 7, 2023, Cypher Protocol on Solana suffered an estimated $1 million exploit. A smart-contract state-tracking and margin-check failure let an attacker take loans that should have been disallowed; Cypher froze its contracts while investigating.
How it happened
- Cypher primary accounts could have sub-accounts; normally their collateral was shared, but isolated sub-accounts were intended to disable that sharing.
- Switching a sub-account to isolated state did not update the primary account's cached state.
- A separate error in the borrow margin checks, together with inactive oracle price feeds, allowed borrowing when it should have been rejected.
- The attacker used multiple primary accounts to take bad loans, leaving the protocol with the resulting debt; Cypher froze its contracts after the incident.
Protocol details
Classification
Oracle Manipulation / Exchange (DEX)
Protocol Type
Derivatives
Protocol links
Website
@cypher_protocol
Evidence
- report @cypher_protocol incident report twitter.com
- report @DeDotFiSecurity incident report twitter.com
- analysis Website reference cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Explained: The Cypher Protocol Hack (August 2023) halborn.com
- analysis Solana-Based Cypher Protocol Experiences Exploit, Freezes Smart Contract coindesk.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
