What happened
On November 2, 2022, an attacker manipulated the price of Hubble's USDH stablecoin to drain three of Solend's isolated lending pools on Solana: Stable, Coin98 and Kamino. Solend's USDH price came from a Switchboard oracle that only read a single low-liquidity Saber pool. The attacker pumped USDH on that pool, kept arbitrage bots from correcting it within the same slot, and let the oracle record the inflated price. It then deposited USDH as overvalued collateral and borrowed against it, leaving Solend with about $1.26 million in bad debt.
The attacker had already tried the same approach on October 28, spending 200,000 USDC, but arbitrage restored USDH to $1 in the same slot before the oracle updated. Solend disabled the three affected pools and notified exchanges of the exploiter's address, and Solend DAO proposals SLND5 and SLND6 later covered the bad debt so users were made whole. Solana Labs CEO Anatoly Yakovenko argued the event was market manipulation of an oracle that relied on a single thin pool rather than a code exploit.
Affected pool accounts:
- Coin98 pool:
5twXA9pwa6P3pmKz5NRiviffgGT1bqmf5d1dXVxJL895 - Stable pool:
HZ75yaVXYA4buymgZhzkLoPPyWyRGskg6hWTgkcnsWwL - Kamino pool:
6e72R9KbYrc1RZiXd6ToF7fMyjGLrAf2itqApQyWGWWn
How it happened
- The attacker spent about 100,000 USDC buying USDH on the Saber pool that Switchboard used as its only USDH price source.
- It then spammed transactions touching the Saber pool account, write-locking it so arbitrage transactions could not land in the same slot.
- In the next slot the attacker arbitraged the pool itself, timing the sequence so that the Switchboard oracle picked up the inflated USDH price before it was corrected.
- With USDH overvalued, the attacker deposited USDH into Solend's Stable, Coin98 and Kamino isolated pools and borrowed other assets against it, about $1.26 million in total.
- When USDH returned to $1, the loans were undercollateralized, leaving about $1.26 million of bad debt; Solend disabled the pools and the DAO voted to cover the shortfall.
Protocol details
Security review history
- Kudelski Security View report
Evidence
- report Report coindesk.com
- report @solendprotocol incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis DeFi Protocol Solend Struck by $1.26M Oracle Exploit coindesk.com
- analysis 2022 Solana Hacks Explained: Solend ackee.xyz
- analysis Solend exploited for $1.26 million in market manipulation attack theblock.co
- analysis Another DeFi Hack! Solana's Solend Suffers $1.26M Exploit coinchapter.com
- analysis solscan.io address 5twXA9…L895 solscan.io
- analysis solscan.io address 6e72R9…GWWn solscan.io
- analysis solscan.io address HZ75ya…sWwL solscan.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
