What happened
On July 9, 2025, Texture Finance's USDC vault was exploited for approximately $2.2 million. A technical incident account reports that a vault rebalance accepted an attacker-controlled SPL token account because it checked the LP-token mint but not that the destination account was owned by the vault. The attacker redeemed the received LP tokens for USDC.
Texture placed reserves in safe mode, and the attacker later returned $1.98 million after a 10% bounty offer.
How it happened
- Texture's vault rebalance transferred LP tokens to a destination account.
- The path verified the expected token mint but did not verify that the destination account belonged to the vault.
- The attacker supplied an SPL token account they controlled and received LP tokens during a rebalance.
- The attacker redeemed those LP tokens for underlying USDC, draining the affected vault.
- Texture halted outflows and later reported a 90% return under its bounty offer.
Protocol details
Classification
Access Control
Protocol Type
DeFi Protocol
Implementation language
Rust
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
