What happened
On April 26, 2025, an attacker drained 5,726,724.97 USDC and 1,211.4 SOL from Loopscale's Genesis Vaults. Its final post-mortem reports full fund recovery by April 29 and a separate $29,000 reimbursement for conversion losses.
Technical root cause
Incomplete validation of the RateX pricing program allowed attacker-controlled collateral valuations.
How it happened
- A malicious program impersonated a RateX market and returned an inflated principal-token price through
get_pt_price. - Missing program-ID checks in non-Loop borrowing let this false valuation satisfy collateral health checks.
- The attacker borrowed against inadequate collateral. Loopscale paused operations, negotiated returns, and reopened vault withdrawals on May 8 after further code reviews.
Protocol details
Classification
Protocol Logic / Borrowing and Lending / Oracle Manipulation
Protocol Type
Lending
Implementation language
Rust
Protocol links
Website
@LoopscaleLabs
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
