Vulnerability in Solana contract affects 1,685 Avici users

A vulnerability in a Solana smart contract has affected more than 1,685 users of the crypto app Avici. Their card balances, totalling $500.859,22, were exposed due to a security issue discovered by card partner Rain. Avici promises to fully compensate all affected users and has reported the matter to the FBI.

In brief:

• Card partner Rain discovered a vulnerability in a Solana contract that manages card balances at Avici and a number of other programs.
• In total, 1,685 users were affected, accounting for $500.859,22 in card balances.
• Avici is fully reimbursing all affected users and has filed a report with the FBI’s Internet Crime Complaint Center.

Only card balances affected, wallets remain safe

Card partner Rain discovered the issue earlier in the day. It involved a vulnerability in a specific version of a Solana contract that Avici and a small number of other programs use to store card balances. When users top up their card, the funds are transferred to this separate contract. Only that contract was vulnerable.

Avici users’ own wallets remained unaffected. Both the Solana wallets and the EVM wallets are under the user’s own control and were not involved in the incident. The vulnerable contract has since been updated for all programs involved, and no further unauthorised activity has been observed since, according to Avici.

Full reimbursement and report to FBI

Avici has said that all 1,685 affected users will receive their full card balance back. The company remains in close contact with Rain and other security partners and is closely monitoring the recovery process.

In addition, Avici has filed a report with the FBI’s Internet Crime Complaint Center, the US reporting centre for internet crime. At the time of writing, Solana is trading at $103, down 2.9% over the past 24 hours.