What happened
On July 13, 2026, an attacker drained about $270,000 from Sodium smart accounts associated with Lumi Finance on Arbitrum. The analyzed path targeted the smart accounts rather than a Lumi liquidity-pool contract.
Technical root cause
Sodium accepted an attacker-selected ERC-1271 signer and allowed attacker-controlled paymasterAndData to grant ERC-20 allowances during validateUserOp.
How it happened
- The attacker used an ERC-1271 authorization bypass together with token approvals executed during
validateUserOp. - An attacker-controlled contract was accepted as signer and session key, then received ERC-20 allowances through attacker-controlled paymaster data before the later account-execution calls failed.
Protocol details
Classification
Other / Input Validation
Protocol Type
Algo-Stables
Implementation language
Solidity
Protocol links
Website
@Lumi_Finance
Attacker Address
0xCe1a3BB0b98D0D90C7Dd0620Ab86C9A771888d88
Exploit Transaction
0x630654fb1c8914405c…c7724c6604
Market Context at Time of Hack
Token Price at Hack
$3.12
Evidence
Proof of concept
1 availableSources
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
