Lumi Finance on Arbitrum Suffers Attack on July 13, Resulting in Loss of Approximately $270,000
Lumi Finance on Arbitrum suffered an attack on July 13, resulting in a loss of approximately $270,000.
The attack exploited a logic flaw in the validateUserOp function of the Sodium smart account contract ERC-4337, where the signer parameter was set to the attacker's address during the _validateSignature call, causing ECDSA.tryRecover to fail without reverting, and instead calling the attack contract's isValidSignature for validation.
Market mechanisms reveal that the ERC-4337 account abstraction vulnerability exposes blind spots in smart contract audits, putting pressure on protocol liquidity providers and user funds. After profiting, the attacker quickly transferred the funds, while similar projects face a short-term trust crisis, with capital flowing towards DeFi protocols that have strict audits or have already fixed the vulnerabilities.
Source: Public Information
ABAB AI Insight
Lumi Finance, as a DeFi project on Arbitrum utilizing the Sodium smart account for ERC-4337, has exposed signature verification risks in the account abstraction implementation. There have been previous cases of fund losses due to similar ERC-4337-related vulnerabilities.
In terms of capital pathways, the attacker manipulated the signature verification to bypass checks and extract funds, strategically exploiting edge cases where the contract logic did not revert, highlighting the security costs of complex account abstraction implementations.
Similar to past cases where multiple DeFi projects were exploited due to signature or verification flaws, the current early adoption phase of ERC-4337 is marked by a high incidence of security events, prompting protocol teams to enhance audits and formal verification.
This essentially represents a risk transfer in technological substitution; while ERC-4337 simplifies user experience, it introduces new attack vectors, mechanically concentrating capital towards account abstraction implementations with robust security mechanisms, forcing DeFi projects to seek a balance between convenience and security.
ABAB News · Laws of Cognition
Signature verification not reverting is the gateway for fund outflow.
The more complex the account abstraction, the larger the audit blind spots.
DeFi security is not a feature, but a prerequisite for survival.