Security Incident · Solana Ecosystem
Avici Smart Contract Vulnerability: $500.86K Reported Loss
Attackers exploited a vulnerability in an outdated version of Rain’s Solana card contract used by Avici (and a few other programs).
- Reported loss
- $ 500,859.22
- Attack category
- Smart Contract Vulnerability
Incident Overview
By submitting crafted signature bundles to gain unauthorized admin rights via AddCollateralAdmin and then withdrawing collateral, they drained $500,859.22 from 1,685 users’ card balances. Self-custodial wallets were unaffected. The contract was upgraded across all programs, and full refunds were promised.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.