Incident Overview
On July 23, 2026, Solido Cash on the Supra blockchain was exploited due to an oracle fallback misconfiguration on its SOLID vault. An attacker leveraged an invalid stale price fallback to over-mint CASH stablecoins and extract approximately 293.7 million SUPRA tokens (~$73,400 net value), with protocol reserves absorbing the loss so zero user funds were affected.
The exploit stemmed from an oracle misassignment where a stale primary price feed for the SOLID token incorrectly fell back to the $1.00 CASH stablecoin oracle instead of halting or using a proper secondary feed. Treating cheap SOLID collateral as equivalent in value to CASH, the attacker executed atomic contract interactions and manual secondary wallet mints to generate unbacked CASH stablecoins, which were immediately swapped for native SUPRA tokens across local decentralized exchanges. Solido Cash subsequently paused vault interactions and patched the oracle fallback mappings.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Solido Cash, these are the critical security checks that could have prevented this incident (July 2026).
- Verify all logic paths related to Oracle Issue are guarded by proper access controls and input validation
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Solido Cash
The Solido Cash hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.