Solend (now Save) hack — November 2022

Solend, a lending protocol on Solana that now operates under the name Save, was left with $1.26 million of bad debt on 2 November 2022 after an attacker manipulated the price of USDH, a stablecoin issued by Hubble Protocol, and borrowed against it.

Solend priced USDH through a Switchboard oracle feed that drew on a single venue, the USDH/USDC pool on Saber. The attacker bought USDH there to push the quoted price up, then spammed transactions that write-locked the Saber account so no arbitrageur could correct the price within the same slot, arbitraging the position back in the following slot once the oracle had picked up the inflated quote. With USDH marked at several times its real value, the attacker deposited it as collateral in Solend's Stable, Coin98 and Kamino isolated pools and borrowed out the other assets, leaving loans that could not be repaid. Audit firm Ackee Blockchain, which reconstructed the sequence, records that a similar attempt on 28 October had failed. Solend's main pool was not affected.

Solend disabled the three pools, set the USDH open loan-to-value ratio to zero and said it had passed the exploiter's address to exchanges. Ackee reports that governance proposals SLND5 and SLND6 subsequently passed and made users whole for the bad debt.

Published figures agree on $1.26 million. Ackee puts the attacker's outlay for the price push on 2 November at about 100,000 USDC, against 200,000 USDC spent in the failed October attempt.