Raydium exploit costs $1.34 million due to validation error

The decentralised exchange Raydium has been hit by an exploit in which approximately $1.34 million in digital assets was stolen. This occurred through a security flaw in an old version of the AMM V3 programme that had not been active since 2021. The good news: users currently trading via Raydium need not worry.

How the exploit worked

The Legacy AMM V3 was originally designed to deploy liquidity for order books on Serum. When Serum was shut down, that liquidity remained in five abandoned pools. The attacker was able to exploit a critical flaw: the programme insufficiently validated the identity of the LP token, allowing someone to use a fake token.

Through this validation error, the attacker was able to bypass the ratio checks and gain access to approximately 150,177 RAY, 5,603 SOL and 893,700 USDC. The address of the exploiter is 4WnPebowR4HHfumvNPaDjG6Pa5Hi1jxLm6xmmBq33QVk.

No risk for active users

The key fact is that current Raydium users have nothing to worry about. Raydium’s SDK and DApp do not support interactions with the Legacy AMM V3 pools, so no one could have worked with them anyway. All other Raydium mainnet programmes use better security mechanisms and validate LP tokens correctly.

Raydium guarantees full compensation from the company treasury. At the same time, Raydium’s core team members are conducting a thorough security audit of all mainnet programmes. The flaw was a result of internal logic errors, not compromised keys or authority conflicts, so there is no risk of the problem spreading further.

Focus on future security

This incident underscores the importance of regular security audits in the world of decentralised finance. Although this involved an old, outdated version, it shows that even unused systems can pose risks. The cyber threat to crypto platforms remains an ongoing concern, as we saw earlier with other hacks in the crypto landscape.