ChainBleedv0.1 · open intel
← back to feed·SOLLOGIC2022-03-23 · 4y ago
Incident · DEFILLAMA

Cashio

Collateral Validation Exploit
Estimated loss
$48.00M
VERDICT —AUDIT-CATCHABLE
Missing account-ownership validation in a Solana account-graph is the textbook static-analysis target. Any persona auditing Anchor-style constraints or a contract-map skill walking the account validation chain catches a missing `has_one` / address constraint.
▰ METHOD
Collateral Validation Exploit
LOGICBYTECODE CATCHABLEAI SCANNABLE
Root cause

Cashio's `print` instruction on the Saber-based stablecoin minted CASH against Saber LP tokens supplied as collateral, but the `crate_collateral` account validation chain was incomplete. The program verified that the user's `collateral` token account matched a `bank` PDA, and that the `bank` referenced a `crate_token`, but it never verified that the `saber_swap.arrow` account passed in was itself the canonical arrow for that collateral mint — the constraint only checked the arrow pointed at the collateral, not that the arrow was authorized. The attacker constructed a fake Saber pool, minted worthless fake-LP tokens, deposited them as `collateral`, and the `print_cash` logic credited their account as if real BTC-USDC LP was deposited. Two transactions minted ~2 billion CASH which was swapped to USDC/UST and bridged out. Root cause is a missing PDA-derivation/ownership check in the account-constraint graph — a classic Solana account-confusion bug.

Forensic narrative

Classification: Protocol Logic. Technique: Collateral Validation Exploit. Target type: DeFi Protocol. Affected chains: Solana. Implementation language: Rust.

Primary source
https://medium.com/cashio/cashio-exploit-post-mortem-6e7717ec2bbf
Sourced from
DefiLlama Hacks dataset · api.llama.fi/hacks
Technical record
chain
solana
protocol
Cashio
bug_class
logic
date_occurred
2022-03-23
loss_usd
$48,000,000
classification
Protocol Logic
technique
Collateral Validation Exploit
target_type
DeFi Protocol
language
Rust
source_id
dl:793
Related — same bug class· logic
2026-05-13
28d ago
TRON
Transit Finance
Deprecated Smart Contract Exploit
logic
$1.88M
UNRATED
2026-05-13
28d ago
ETH
TAC Cross-Chain Layer (TON Side)
Contract Vulnerability
logic
$2.80M
UNRATED
2026-05-13
28d ago
ETH
Transit Finance
Contract Vulnerability
logic
$1.88M
UNRATED
2026-05-12
29d ago
ARB
Aurellion
Uninitialized Proxy Exploit
logic
$456.0K
UNRATED
2026-05-12
29d ago
BSC
SQ Protocol
Acces Control Exploit
logic
$346.0K
UNRATED
2026-05-12
29d ago
BSC
SQ Protocol
Contract Vulnerability
logic
$346.1K
UNRATED
ChainBleed — live web3 threat intelligence