Raydium hack — December 2022

On 16 December 2022 at 10:12 UTC an attacker gained control of the account holding the pool-owner authority over Raydium's constant-product liquidity pools on Solana. Raydium's post-mortem said there was no evidence the private key had ever been passed, shared, transferred or stored outside the virtual machine that held it, and offered a trojan on that machine as one possibility. The intrusion vector was never established.

With the authority key the attacker did not simply move pool balances. Raydium's withdrawPNL instruction exists to collect accrued protocol fees for RAY buybacks, and the amount it releases is governed by the need_take_pc and need_take_coin parameters. The attacker used SetParams and SyncNeedTake to inflate those two values without any trading having occurred, then called withdrawPNL repeatedly, draining eight pools of what the program believed were fees owed to the protocol.

Raydium's own accounting put the loss at approximately $4.4 million, the figure The Block used. CertiK's analysis put it higher, at about $5.5 million, and traced roughly $2 million bridged to Ethereum and routed through Tornado Cash. Raydium offered a 10% bounty plus the exploited RAY balance for the return of the assets; it was not taken up.

Raydium compensated liquidity providers from its treasury and from vested team token reserves. Providers in RAY pairs could claim 100% of principal lost; providers in the other affected pairs, including SOL-USDC, SOL-USDT, stSOL-USDC and whETH-USDC, could claim 90% in kind, with the remaining 10% paid in RAY at a 1.2x rate. Claims opened 5 January 2023 and closed 14 May 2023.