Raydium DEX says $1.34 million exploit hit retired AMM program, treasury to cover losses

Solana-based decentralized exchange Raydium said Wednesday that an exploit targeting its legacy AMM V3 program resulted in the removal of roughly $1.34 million in assets from a handful of inactive liquidity pools.

The affected pools included RAY-SOL, USDC-RAY and SRM-RAY pairs, with the attacker draining around 150,000 RAY, 5,600 SOL, and nearly 900,000 USDC according to early estimates. 

Raydium said all losses will be compensated by its treasury.

According to the protocol, the exploit affected an automated market maker program that was phased out in 2021 and hadn't been accessible through Raydium's interface since. 

The company said no current users were impacted and that its "SDK and DAPP do not support mainnet interactions with legacy AMM V3 pools."

The vulnerability reportedly "stemmed from insufficient validation of the LP mints," which allowed an attacker to bypass "intended proportion checks."

Raydium added that its current mainnet programs are unaffected and are now undergoing a separate security review. 

The DEX's native RAY token has seen little impact and is trading up more than 2% on the day, according to The Block's crypto price page.