Digital Asset
Intelligence
Security Incident · Solana Ecosystem

Avici Smart Contract Vulnerability: $500.86K Reported Loss

·Historical incident record

Incident Overview

Attackers exploited a vulnerability in an outdated version of Rain’s Solana card contract used by Avici (and a few other programs). By submitting crafted signature bundles to gain unauthorized admin rights via AddCollateralAdmin and then withdrawing collateral, they drained $500,859.22 from 1,685 users’ card balances. Self-custodial wallets were unaffected. The contract was upgraded across all programs, and full refunds were promised.

Sources & References

Original incident referencehttps://x.com/avici/status/2093439613201482068?s=46&t=DLwbX9Nw4QECiyZQ0av-fg (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Dominion

    Attack methodPrivate Key Leakage
    Reported loss$ 238,000
  2. Incident date
    Attack methodValidation Flaw
    Reported loss$ 98,000
  3. Incident date
    Attack methodFlash Loan Price Manipulation
    Reported loss$ 1,650,000
  4. Incident date
    Target

    Full Sail

    Attack methodOracle Manipulation
    Reported loss$ 91,000
  5. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 117,400