# SummerFi FleetCommander NAV inflated via depegged xUSD collateral

SummerFi FleetCommander NAV counted depegged xUSD-backed vgUSDC at par; attacker minted cheap vgUSDC, donated to empty ark to inflate NAV, redeemed for ~$6M.

- Payout: Real-world hack
- Severity: critical
- Program: SummerFi
- Credited: DeFiHackLabs
- Disclosed: 2026-07-06
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-07/SummerFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260706-summerfi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** FleetCommander vault NAV / SiloManagedVault ark
**Root cause:** FleetCommander NAV is the live sum of each Ark's totalAssets() with no manipulation guard; a Silo ark follows vgUSDC which counts depegged Stream USD (xUSD) collateral at par.
**Steps:**
1. Flash loan 1M USDT via Morpho, then 65.4M USDC inner flash loan.
2. Swap 20k USDT -> xUSD on Uniswap V4, then xUSD -> vgUSDC on Balancer V3 at depegged discount.
3. Deposit dominant vgUSDC position into FleetA ark (SiloManagedVault 0x61d70630).
4. Donate cheap vgUSDC into the empty ark to inflate FleetCommander NAV.
5. forceDeallocate on VaultV2 arks to free ~4.4M withdrawable liquidity.
6. Redeem inflated shares for DAI/LVUSDC, swap USDC->DAI via Curve 3pool, repay flash loans.
**How found:** Recognized that FleetCommander NAV trusts Ark totalAssets() and that a Silo ark prices depegged xUSD collateral at par, enabling share-price inflation via donation into an empty ark.
**Exploitation:** Attacker used nested Morpho flash loans (1M USDT + 65.4M USDC) as capital, acquired vgUSDC cheaply via depegged xUSD on UniV4/BalancerV3, seeded a dominant position in FleetA, donated vgUSDC to the empty ark to spike NAV, forced ark liquidity via forceDeallocate, then redeemed inflated shares draining other LPs (~5.6M DAI from FleetA, ~0.4M from FleetB).
**Escalation:** Chained two FleetCommander legs (FleetA + FleetB) and forceDeallocate across multiple Morpho-backed VaultV2 arks to maximize withdrawable liquidity.
**Insight:** When a vault's NAV sums external ark totalAssets(), check whether any ark prices a depegged/illiquid asset at par and whether an empty ark can be donated into to move share price before redemption.