Raydium is aware of an exploit involving unauthorized removal of liquidity from its legacy AMM V3 program which was previously phased out in 2021.
No current users of Raydium are affected by this exploit or would have been able to interact with these pools through the UI since their deprecation. Raydiumβs SDK and DAPP do not support mainnet interactions with legacy AMM V3 pools.
The exploiterβs address is: 4WnPebowR4HHfumvNPaDjG6Pa5Hi1jxLm6xmmBq33QVk
There were 5 pools affected:
Sollet USDT - RAY
Sollet ETH - RAY
SRM - RAY
USDC - RAY
RAY - SOL
An initial review of exploited assets of value are:
~150,177 RAY
~5,603 SOL
~893,700 USDC
The market value of assets exploited is ~$1.34m. Full compensation will be handled by Raydiumβs treasury.
Legacy AMM V3 was previously only enabled to use deposited funds to place orders on the Serum order book. The program did not provide swap functionality and following the deprecation of Serum, the associated liquidity remained idle. For proportion checks, the program relied on the LP token supply.
The vulnerability stemmed from insufficient validation of the LP mint. Because the program did not properly verify the LP mint address, an attacker was able to create a new mint and use it as the LP token, bypassing the intended proportion checks.
By contrast, all other Raydium mainnet programs use a virtual supply mechanism for proportion checks and correctly verify the LP mint along with all other relevant account information, preventing this class of vulnerability.
It is important to note that the vulnerability was caused by a self-contained logic flaw, not a key compromise or authority-level issue, so there is no propagation risk.
Raydium's current programs are unaffected by this exploit.
@Raydium core contributors are conducting a security review on all mainnet programs.