Summer.fi Lazy Summer Protocol — Flash Loan NAV Manipulation

Timeline: July 6, 2026, 05:17:59 UTC: attacker executes a single atomic transaction — donates stale-valued Silo 'Varlamore USDC Growth' vault tokens (mispriced on-chain since the November 2025 Stream Finance collapse) into a deposit-capped Ark still counted in NAV calculations, inflating vault NAV by ~9.5%; borrows a ~$65.4M flash loan via Morpho; redeems shares at the inflated price of ~1.1678 USDC/share versus the true ~1.0665 USDC/share, netting ~$6.04M ($5.64M from the lower-risk vault, $0.40M from the higher-risk vault). 05:36 UTC: Blockaid detects and flags the live exploit. 06:42 UTC: Block Analitica freezes deposits on affected vaults. 07:39 UTC: SEAL 911 engaged. 07:52 UTC: first Guardian Safe multisig transaction. 09:48 UTC: on-chain message sent to the attacker's address from the Lazy Summer deployer. 10:25 UTC: deposit caps set to zero on DAO-managed vaults, Ethereum and Base vaults paused. 11:38 UTC: Arbitrum and Sonic vaults paused as a precaution. 16:39 UTC: Foundation Multisig sweeps remaining Silo Varlamore shares out of the affected vault. 17:16 UTC: Summer.fi contacts FixedFloat regarding the attacker's initial funding. July 7, 2026: full official post-mortem published, confirming contracts behaved as coded and the root cause was a process failure (incomplete Ark offboarding), not a smart contract bug. July 8, 2026: further reporting traces the root cause directly to the November 2025 Stream Finance collapse. Compensation for affected depositors remains an open Lazy Summer DAO governance decision as of this report; no final per-depositor reconciliation has been published.