Solido Money: A Stablecoin Priced By A Broken Mirror, Drained Twice In One Day
The code wasn't hacked. The price was.
Solido Money is a DeFi lending and stablecoin protocol on Supra. Users deposit collateral, mint $CASH, and can convert $CASH into $SUPRA — a whole cathedral built on the assumption that the oracle telling the contract 'this collateral is worth X' is telling the truth. It wasn't. The attacker paid one deposit, made the mirror lie, walked out with 809,052 CASH in a single transaction, and then — because pulling the front-end offline is not the same as fixing a smart-contract bug — came back hours later and did it again across five wallets. This is what happens when the UI is treated as security.
The Scheme
Solido Money used an oracle path that priced the collateral asset with a feed the attacker could push. In a single atomic transaction, they deposited overvalued collateral, minted 809,052 $CASH, converted the $CASH into $SUPRA, and left. The team pulled the front-end. The smart contract kept working. Hours later, the exact same technique was executed manually across five wallets, because the mint function on-chain didn't care that the website was down.
Taking the UI offline is security theatre. Only an on-chain fix — permanently disabling the exploited mint path — actually closed the door.
The Uncomfortable Part: This Wasn't A Code Bug
The Solido contracts did exactly what they were programmed to do. Accept collateral, ask the oracle what it's worth, mint the corresponding $CASH. There was no reentrancy, no unchecked delegatecall, no arithmetic overflow. The vulnerability lived in a place most audits still treat as 'someone else's problem': the price feed itself.
A stablecoin/lending protocol is a bet on the oracle. Every line of the mint function assumes the number coming in from the price feed is honest. The attacker didn't rewrite the contract — they rewrote the number. And because the collateral in question had a thin liquidity source with no TWAP smoothing and no manipulation cap, rewriting the number cost less than the mint it authorised.
The scariest sentence in the post-mortem is the quiet one: 'the vulnerability lived in the smart contract, not the website.' It's scary because the team's first instinct was to fix the website. That's the instinct of a marketing team, not a security team. In DeFi, pulling the UI buys you exactly zero minutes against an attacker with a script.
A stablecoin is only as safe as its price feed. Period.
Anatomy Of An Oracle Manipulation
Oracle manipulation isn't magic. It's arbitrage against a design choice. Somewhere in the deployment, a team decided the collateral would be priced using a single source, or a mean of thinly-traded sources, without a time-weighted average and without a circuit breaker for outlier prints. That decision saved them a Chainlink subscription. It cost users 809,052 CASH the first round and a repeat performance later the same day.
The pattern is boringly consistent. Attacker identifies the price source. Attacker moves the price source (a wick on a low-liquidity pair is usually enough; sometimes it's a flash-loaned swap; sometimes it's a signed oracle report the attacker can influence). Attacker interacts with the vulnerable protocol in the same block or same window before the price mean-reverts. Mint, borrow, or drain. Exit.
The Solido Money case has one extra beat that separates a competent post-mortem from a good one: wave 2. After the team pulled the front-end, the attacker executed the same mint path manually across five wallets. That means the exploit was never actually mitigated between waves — it was hidden. The website coming back would have been the same as the website never leaving.
Round one is a bug. Round two, hours later, on the same contract, is a policy.
Vocabulary Decoded: What The Statement Meant
What Solido said vs what actually happened:
"Oracle misconfiguration"
What it sounds like:
A one-off settings mistake that a fresh deploy will correct.
What actually happened:
The protocol picked a price path with no TWAP, no deviation cap, and no circuit breaker — because a proper oracle costs money and shipping fast doesn't. 'Misconfiguration' is a polite word for 'we optimised for launch, not for a $1M collateral position.'
"We've paused the front-end"
What it sounds like:
The protocol is safely offline while the team investigates.
What actually happened:
The website is down. The smart contract is still open. Any wallet with a JSON-RPC endpoint and the ABI can still hit the vulnerable function. Pulling the UI is a message to the community, not to the contract.
"A contract-level fix has been deployed"
What it sounds like:
The vulnerability has been architecturally re-engineered.
What actually happened:
The exploited mint function was permanently disabled — the only remediation that actually works after an oracle hack. This is the correct move, but it also means the affected functionality is gone. If the team promises 'the feature will return shortly,' assume the trust model hasn't changed.
'Website down' is not a fix. 'Function disabled' is.
How A Stablecoin Gets Priced By A Broken Mirror
Four decisions, made months before the exploit, that always ship together:
Decision 1: Ship With A 'Good Enough' Oracle
The team picks a price source that works on the largest, most liquid pair but has no fallback for the specific collateral they'll accept at launch. A single feed, no time-weighted average, no manipulation cap, no deviation check against a secondary source. It's cheaper, it's faster, and it's fine — until the first serious position is opened.
Every oracle-manipulation post-mortem includes the phrase 'we intended to upgrade the oracle before mainnet.' Nobody ever does.
Decision 2: Accept Collateral With Thin Liquidity
A new chain, a young stablecoin pair, a token whose only real market is one AMM pool. Anything that can be pushed on-chain for less than the mint it authorises. If your collateral can be moved 5% with a $50k trade and your protocol will mint you $1M against it, congratulations — you've written the attacker's proposal.
'It'll never move that much' is the second-most-expensive sentence in DeFi. The first is 'the oracle is fine.'
Decision 3: Treat The UI As A Security Control
The runbook says 'in case of incident, disable the app.' The runbook does not say 'in case of incident, guardian-pause the contract.' There's a difference. One stops normal users. The other stops the attacker who's already reading the transactions on a block explorer.
The attacker never used the front-end. Why would you assume pulling it inconveniences them?
Decision 4: Announce Before You Understand
A statement goes out within hours, using the words 'isolated,' 'contained,' and 'under investigation.' The community reads it as reassurance. The attacker reads it as a hint: whatever the team hasn't specifically addressed is still open. Wave 2 lands before the second statement is drafted.
The gap between 'the site is offline' and 'the function is disabled' is exactly the size of a second exploit.
Technical Kill Chain: One Day, Two Waves
Reconstructed from Solido Money's own disclosure and independent on-chain analysis:
T-0: Wave 1 — One Atomic Transaction
Attacker deposits overvalued collateral into Solido's vault. The oracle returns the manipulated price. The mint function authorises 809,052 $CASH. The attacker immediately converts the $CASH to $SUPRA and exits — all in one transaction, one block, no MEV window for anyone to react.
Atomic execution isn't sophisticated. It's what happens when you don't leave the attacker any state to explain to a router.
T+minutes: The UI Comes Down
Team detects the drain — probably via a Discord ping, possibly via a treasury alert. Front-end is pulled offline. A short statement is posted. Users are told the protocol is 'safely paused.' The smart contract mint function is still callable.
'Safely paused' at the UI layer means the same as 'unlocked and unattended' at the contract layer.
T+hours: Wave 2 — Five Wallets, Same Trick
The attacker (or a copycat reading the on-chain post-mortem) repeats the mint path manually across five separate wallets, bypassing the offline website entirely. Each wallet interacts directly with the vulnerable contract via RPC. More $CASH minted. More conversion to $SUPRA. Same door.
Waves like this are why 'we've disabled the app' fails the sniff test as a fix.
T+later: The Actual Fix
The team deploys a contract-level change that permanently disables the exploited mint path. The oracle architecture is quietly rebuilt in the background. This is the only step that actually mattered. Everything before it was public relations.
The only remediation that survives contact with a determined attacker is one that changes the contract, not the marketing.
Two waves. One contract. Zero on-chain remediation until wave 3 was already priced in.
The Oracle Tape: The Moment The Mirror Cracked
A simplified reconstruction of the $CASH price feed exactly as the protocol read it. No magic here — just one misconfigured number and a contract far too polite to argue.
* Price frozen by configuration, not by market. Figures rounded for illustration.
An oracle never lies. It repeats exactly what you taught it — even after the world has changed its mind.
The Outlier Test
The standard already existed. Set against comparable stablecoin protocols, Solido wasn't innovative — it was simply the one off the curve.
| Control | Common practice | Solido |
|---|---|---|
| Price sources | Several, with a median | A single one |
| Time window | TWAP over minutes | Instant spot price |
| Deviation cap | Pause if the jump clears the threshold | No brake |
This wasn't an unknown failure. It was a homework list everyone did — except one.
Why LPs Deposit Into Redesigned Protocols Anyway
Solido will relaunch the affected feature. When it does, most of the same wallets will re-deposit. Here's why the pattern survives.
Ecosystem Yield
A young ecosystem needs stablecoin liquidity. Emissions and incentives spike. A relaunched protocol is often the highest-APR game in town — and the market forgets an oracle bug in about six weeks.
'They've Been Hardened'
There's a persistent folk belief that a protocol that survived an exploit is safer for it. The truth is the opposite: it's a protocol that has proved it will fix a symptom under pressure, then let users back in before the trust model has been re-audited.
Cross-Chain FOMO
New L1s reward the first serious lending market with disproportionate mindshare. Depositors treat 'first to relaunch' as 'first to compound.' It's usually 'first to fund the next audit.'
Ecosystem Vouches
A Supra-branded partner tweet or a launchpad co-sign gets read as due diligence. It's marketing. It's not a threat model.
Oracle-manipulation protocols don't survive on user stupidity. They survive on user hope — and hope is the only asset in DeFi with unlimited supply.
How Not To Fund The Next Oracle Attack
Six rules for the next time a lending protocol on a new chain quietly opens the mint function:
- Rule 1: Read the oracle section of the docs first If the docs don't name the exact feed, source count, TWAP window, and deviation cap, assume there isn't one.
- Rule 2: If the fix was 'we took the site down,' it wasn't a fix Only a contract-level change — a permanently disabled function, a new oracle module behind a time-lock — counts as remediation. Everything else is uptime management.
- Rule 3: Check the liquidity of the collateral, not the token It doesn't matter that $SUPRA has $100M of book depth if the collateral you're depositing prices off a pool with $200k of liquidity. The attacker only needs to move the mirror.
- Rule 4: Treat 'the feature will return shortly' as a warning A relaunch inside four weeks means the oracle module was patched, not re-architected. Skip the first cohort.
- Rule 5: Watch for wave 2 before you re-enter If the same exploit ran twice in one day, assume the contract-level fix took more than a day. Wait until the post-mortem includes the phrase 'permanently disabled' — verbatim.
- Rule 6: Size for the round you don't see coming If you must return, size the position for the loss you'd accept in a wave 3 you didn't get warned about. Because in oracle-bug protocols, wave 3 is where the retail money quietly goes.
Got a Suspicious Message?
Use our AI-powered detector to analyze potential scams instantly.
Key Takeaways
- 1Solido Money's contracts were not hacked in the code sense — the oracle telling the mint function 'this collateral is worth X' was manipulated, and 809,052 $CASH was minted and converted to $SUPRA in a single atomic transaction.
- 2Pulling the front-end offline did nothing to stop the exploit. Hours later, the same technique ran manually across five wallets, because the smart-contract mint path was still open.
- 3The only remediation that actually worked was a contract-level change — permanently disabling the exploited minting function. Everything before it was community management.
- 4A stablecoin/lending protocol is only as safe as its price feed. No TWAP, no deviation cap, no circuit breaker equals no meaningful defense against oracle manipulation.
- 5The 'we've paused the app' response is a leading indicator that the team is optimising the statement, not the security. Wait for the words 'permanently disabled.'
- 6If the feature relaunches, wait until a fresh audit of the oracle module — not the mint function — is public. And size the position for a wave you didn't get warned about.
The contract wasn't wrong.
It just believed the wrong number.
Frequently Asked Questions
Sources & Citations
Research for this investigation compiled from publicly available blockchain data, security reports, and community documentation.
solido.money
slowmist.com
peckshield.com
suprascan.io
Verification: All blockchain transactions and addresses referenced in this article can be independently verified through the linked blockchain explorers. We encourage readers to conduct their own verification.
Methodology: Every case requires at least three independent sources plus verifiable on-chain evidence before publication. Full standards: /methodology
Legal notice: This assessment is based on publicly available data, including on-chain records, official statements and reported incidents. It is journalistic and educational analysis, not legal advice, an accusation of criminal conduct or a court finding. Named companies, projects, domains, wallets and individuals are described as reported by the cited sources; a company name may appear because fraudsters impersonated it, not because the company did anything wrong. If you believe something is inaccurate or out of date, write to cryptostrapon@proton.me and we will correct it and log the change. Editorial policy