Solana-based stablecoin protocol Cashio was exploited in an “infinite glitch” attack, developers said on Wednesday.
- Following the exploit, the value of Cashio's CASH token dropped to nearly zero.
- “Please do not mint any CASH. There is an infinite mint glitch. We are investigating the issue and we believe we have found the root cause. Please withdraw your funds from pools,” the team wrote in a tweet.
- CASH is a stablecoin pegged to the U.S .dollar and is backed by USDC and USDT via a liquidity pool on Saber, a Solana-based market maker. Users can mint their CASH by providing liquidity with USDT and USDC.
- The incident on Wednesday allowed the hacker to manipulate Cashio’s smart contracts to mint an infinite supply of CASH without providing any liquidity in return. Blockchain data shows over 2 billion CASH were minted, without any USDC or USDT backing.
- The hacker used the newly minted tokens to exchange them for stablecoins on Cashio’s liquidity pools. Data from tracking tool DeFiLlama shows the total value locked on Cashio dropped by $28 million after the attack.
- Stablecoins based on other protocols has suffered similar attacks in the past. Polygon-based Safedollar dropped to $0 after an exploit in June 2021, with both USDC and USDT siphoned off by the hacker at the time.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.