Haedal Vault — Cross-Version AUM Mismatch Exploit

Timeline: On June 9, 2026, two attackers exploited a cross-version logic inconsistency in Haedal Vault's LP share minting mechanism across six vault pools on Sui. The root cause was a forced upgrade gap: when Haedal published the v3 Vault package on December 23, 2025, older deposit entrypoints were not fully deprecated and remained callable. The v1/v2 deposit path used an understated AUM calculation for CLMM/DLMM liquidity positions, causing it to mint more LP shares than the actual deposited value warranted. The v3 withdrawal path, however, redeemed LP shares against the Vault's real underlying assets. By depositing through the old path and withdrawing through the new one, the attackers received a larger share of real assets than they deposited. The two addresses executed 206 total transactions across the six affected pools. Total direct loss: $915,179.68 across USDC, SUI, CETUS, DEEP, WAL, LBTC, and ETH. Haedal detected the unusual liquidity decline, paused vault contracts before further deterioration, and published a full post-mortem the same day. All losses will be covered by Haedal Foundation reserves. A patched version is under development and will undergo re-audit before deployment.