Originally published at Loopscale: Pricing Misconfig and NAV Loan Exploit
On 5 November 2026, Loopscale — a Solana order-book lending protocol built around fixed-rate, overcollateralized credit markets and Genesis Vaults — paused operations after a week-long campaign of malicious API traffic. The next day the team published a two-path disclosure: a SOL Genesis Vault pricing misconfiguration that enabled an undercollateralized loan of approximately $412K, and a USDC Genesis Vault NAV-inflation attempt that sought a disproportionate redemption of approximately $521K, which Loopscale says their systems halted within 30 seconds of transaction generation.
This post summarizes only what Loopscale and corroborating public reports disclosed. We did not find published Solana transaction signatures for either path in those sources, so the analysis follows the team's disclosed paths rather than independently reconstructed receipts. Treat any illustrative logic as a simplified illustration, not verified Loopscale program source — the team did not publish program snippets in the posts we cite.
TL;DR
- Target: Loopscale Genesis Vaults on Solana (SOL and USDC vaults called out).
- Window: Week-long campaign of more than 30,000 malicious API requests per day, culminating in a pause on 5 Nov 2026; detailed two-path update on 6 Nov 2026.
- Path 1 — SOL Genesis Vault pricing misconfiguration (~$412K): a misconfigured combination of asset-pricing parameters valued deposited collateral as a different asset, enabling an undercollateralized loan of about $412K.
- Path 2 — USDC Genesis Vault NAV inflation (~$521K halted): an atomic transaction bundle sold a loan carrying an extreme interest rate into the USDC Genesis Vault, inflating its NAV and enabling a disproportionate redemption of about $521K, which Loopscale says was halted within 30 seconds.
- User impact (per Loopscale): affected vaults have been made whole; no user deposits have incurred a loss, and no user deposits will incur a loss.
- Restoration status (6 Nov): priority lending restored; collateral top-ups for all loans; repayments for all except USDC Genesis Vault-funded loans; collateral withdraw after full repay OK except for USDC Genesis Vault-funded loans; vault withdrawals still restricted.
- On-chain Solana signatures for these paths were not published in the primary sources below — do not invent them.
What Loopscale Disclosed
Loopscale's pause announcement on 5 November 2026 framed the event as the end of a week of coordinated probing. Protocol APIs received more than 30,000 malicious requests per day. Attack attempts targeted the SOL and USDC Genesis Vaults. Both paths involved sophisticated, multi-step transactions aimed at publicly inspectable program logic and private transaction-building APIs.
The 6 November update separated the economic story into two failure modes:
| Path | Vault | Mechanism (per Loopscale) | Figure | Outcome |
|---|---|---|---|---|
| 1 | SOL Genesis Vault | Misconfigured asset-pricing parameters valued collateral as a different asset | ~$412K undercollateralized loan | Vault made whole; no depositor loss per team |
| 2 | USDC Genesis Vault | Atomic bundle sold an extreme-rate loan into the vault, inflating NAV | ~$521K disproportionate redemption | Halted / intercepted within ~30 seconds; vault made whole; no depositor loss per team |
Total exposure framing: roughly $412K of undercollateralized borrowing plus a ~$521K attempted redemption that was stopped — not a permanent ~$933K depositor loss. Loopscale's public position is that vaults were made whole and depositors did not — and will not — take a loss.
Path 1 — SOL Genesis Vault Pricing Misconfiguration
Order-book lending and vault products live or die on whether collateral is priced as the asset the depositor actually posted. Loopscale says an attacker exploited a misconfigured combination of asset-pricing parameters so that collateral deposited in the SOL Genesis Vault was valued as a different asset. With that wrong valuation in place, the protocol allowed an undercollateralized loan of approximately $412K.
That is a configuration / pricing-parameter failure, not a claim that Solana consensus broke. The dangerous property is familiar from EVM vault incidents: if an internal price table or asset-id mapping disagrees with the asset that actually moved, the protocol lends against fiction. Our CoreVault InsurancePool spot-price exploit is a different chain and bug class, but it shares the lesson that any value-moving path that trusts a mis-set or attacker-movable price will under-collateralize itself.
A simplified sketch of the shape of a pricing-parameter mix-up — not Loopscale source:
# Simplified illustration. Not Loopscale verified source.
# Collateral posted: SOL
# Pricing table (misconfigured): maps vault slot -> price feed for asset X != SOL
posted = deposit(SOL_amount)
value = price_of(configured_asset_id) * posted # wrong asset priced
loan = borrow(value * LTV) # loan sized off fiction
# Result: undercollateralized exposure until parameters are corrected
Without published program snippets or Solana signatures in the cited sources, we cannot assert function names or the exact parameter that was wrong. The verified claim stops at Loopscale's description: misconfigured pricing parameters → wrong asset valuation → ~$412K undercollateralized loan.
Path 2 — USDC Genesis Vault NAV Inflation (Halted)
The second path targeted vault accounting. Per Loopscale, the attacker used an atomic transaction bundle to sell a loan carrying an extreme interest rate into the USDC Genesis Vault. That sale inflated the vault's NAV, which enabled a disproportionate redemption of approximately $521K.
Critically, Loopscale states that their systems halted the redemption within 30 seconds of transaction generation. The ~$521K figure is therefore an attempted / intercepted redemption size, not a confirmed permanent user loss. Reporting it as "stolen" would contradict the team's disclosure.
Vault products that mark NAV from the loans they hold inherit every extreme parameter those loans can carry. An interest rate that is legal in the program but economically absurd can reprice share value if the vault treats the loan mark as authoritative. Atomic bundles on Solana make the inflate-and-redeem sequence hard to interrupt mid-flight unless monitoring and circuit breakers sit close to the transaction-building path — which appears to be what Loopscale credits for the 30-second halt.
# Simplified illustration. Not Loopscale verified source.
# 1) Sell a loan with an extreme interest rate into the USDC Genesis Vault
# 2) Vault marks the loan into NAV -> share price jumps
# 3) Redeem a disproportionate amount against the inflated NAV
# 4) Loopscale: halt / intercept within ~30s of tx generation
Again: no public Solana transaction signatures for this path appeared in the primary sources we used.
Containment, Addresses, and Restoration
Loopscale linked these addresses in its pause disclosure (roles beyond "linked by Loopscale" were not further specified):
| Item | Address |
|---|---|
| Solana | 247Lk5YNH9URfBBvxVUtDruz8GvGX8gKGuYHVCZThpiR |
| Solana | AzPh2dUV3duK9n8PWV6CxKMwWr9Rk7fxPNBZuv1CiwMr |
| EVM | 0xb8959Aca4e4C796A3BaDA66833eAe60b1BC0bfb2 |
| EVM | 0xB7Ec7eF24FD73f3000C651CA9D0Fa45b61DcF854 |
Containment claims (Loopscale): affected vaults made whole; no user deposits have incurred / will incur a loss; priority lending restored on 6 Nov; collateral top-ups for all loans; repayments for all except USDC Genesis Vault-funded loans; collateral withdraw after full repay OK except USDC Genesis Vault-funded; vault withdrawals still restricted.
Brief Historical Context
On 26 April 2025, an earlier Loopscale-related exploit drained roughly 5.7M USDC and ~1,211.4 SOL via RateX principal-token pricing manipulation; funds were later recovered and users took no net loss per contemporaneous reporting. That episode is background only — a different mechanism from the November 2026 Genesis Vault paths — but it underscores why pricing and NAV integrity remain the recurring theme.
Lessons for Builders and Auditors
Treat asset-id and price-feed configuration as security-critical code. A wrong mapping that values SOL collateral as another asset is enough to underwrite an undercollateralized loan.
Bound what a vault may mark into NAV. Extreme interest rates and atomic inflate-then-redeem bundles should fail closed or hit hard caps before share price moves.
Put circuit breakers next to private transaction-building APIs. Rate limits, anomaly detection on request volume (here: >30k malicious requests/day), and automated halts on abnormal redemption size are what turned path 2 into a 30-second intercept.
Assume multi-step, multi-chain follow-through. Publishing both Solana and EVM addresses early helps responders.
Reuse a structured review checklist. Pricing tables, vault NAV marking, and redemption paths are covered in our smart contract security checklist. Atomic funding patterns that amplify a bad mark are cousins of the patterns in our flash loan attack overview, even on Solana.
What Is Still Unknown
- Public Solana transaction signatures for path 1 and path 2 were not included in the Loopscale posts or secondary reports cited below.
- Loopscale did not publish program snippets in those posts; any code-shaped diagrams above are simplified illustrations.
- Exact post-halt accounting (how vaults were made whole) was not detailed in the sources we used.
- Aggregators may list a single headline figure; prefer Loopscale's two-path split (~$412K undercollateralized loan + ~$521K halted redemption) over collapsing both into one "lost" number.
Key Addresses and Figures
| Item | Value |
|---|---|
| Protocol | Loopscale (Solana order-book lending / Genesis Vaults) |
| Chain | Solana |
| Pause / two-path disclosure | 5 Nov 2026 / 6 Nov 2026 |
| Malicious API traffic | >30,000 requests/day over the past week (Loopscale) |
| Path 1 | SOL Genesis Vault pricing misconfig → ~$412K undercollateralized loan |
| Path 2 | USDC Genesis Vault NAV inflation → ~$521K redemption halted within 30s |
| User deposits | Made whole; no loss incurred / will be incurred (Loopscale) |
| Solana (linked) | 247Lk5YNH9URfBBvxVUtDruz8GvGX8gKGuYHVCZThpiR |
| Solana (linked) | AzPh2dUV3duK9n8PWV6CxKMwWr9Rk7fxPNBZuv1CiwMr |
| EVM (linked) | 0xb8959Aca4e4C796A3BaDA66833eAe60b1BC0bfb2 |
| EVM (linked) | 0xB7Ec7eF24FD73f3000C651CA9D0Fa45b61DcF854 |
| Prior incident (background) | 26 Apr 2025 — ~5.7M USDC + ~1,211.4 SOL via RateX PT pricing; funds recovered |
Sources
- Loopscale pause announcement (5 Nov 2026): >30k malicious requests/day; vaults made whole; linked addresses; pause
- Loopscale two-path update (6 Nov 2026): SOL pricing misconfig ~$412K; USDC NAV loan ~$521K halted in 30s; restoration status
- CryptoBriefing: narrative of the pause and Genesis Vault targeting
- crypto.news: API-request volume and halt coverage
- ChainCatcher / Lookonchain / GetChain: corroborating ~$412K / ~$521K figures from official announcements
- DefiLlama hacks entry for Loopscale Lending, 5 Nov 2026
Closing Thoughts
Loopscale's November 2026 incident is a reminder that Genesis-style vaults inherit every assumption baked into pricing parameters and loan marking. One path under-collateralized a loan because collateral was valued as the wrong asset; the other inflated NAV by selling an extreme-rate loan into a vault and racing a redemption — a race Loopscale says it won inside thirty seconds. If you ship fixed-rate credit markets or vault products that mark NAV from loans, talk to our team or check our audit pricing before those parameters and redemption paths go live against real deposits.
Top comments (0)