ORE smart contract bug let attacker drain 25.5 SOL from staking program
A smart contract vulnerability in ORE’s staking program allowed an attacker to improperly claim 25.5 SOL, roughly $2,125, from the protocol’s yield mechanism. The exploit was disclosed on June 17, and while the dollar amount is modest by crypto exploit standards, the incident forced ORE to require all stakers to migrate to an entirely new contract before they can start earning rewards again.
What happened and what ORE is doing about it
ORE is a proof-of-work mining protocol built on the Solana blockchain. The protocol allows miners to stake either SOL or ORE tokens and earn yield generated through protocol revenue, not through token inflation.
The bug in question was located within the staking program’s smart contract. It gave an attacker the ability to claim yield they weren’t entitled to. The protocol has confirmed that user deposits themselves remain secure, meaning the vulnerability was isolated to the yield distribution mechanism rather than the underlying staked assets.
On May 29, about three weeks prior to the disclosure, the protocol froze its staking program as part of a broader security upgrade. That initiative was aimed at permanently locking the contract policy to eliminate potential upgrade authority risks, essentially removing the ability for anyone, including the team, to modify the contract after deployment.
The fix requires stakers to migrate to a new smart contract. Until they do, yield accumulation is paused. No timeline has been publicly shared for how long the migration window will remain open or when a full post-mortem analysis will be published.
What this means for stakers and investors
For current ORE stakers, the immediate action item is clear: migrate to the new contract. Failing to do so means sitting on assets that aren’t generating any yield.
ORE has undergone several iterations since it first launched in early 2024. The protocol communicated the breach primarily through social media, and detailed information regarding the attacker or a comprehensive post-mortem analysis remains undisclosed.
The vulnerability here was in ORE’s staking logic, not in Solana’s infrastructure. Investors evaluating smaller DeFi protocols should treat this as a case study in why audit reports are necessary but not sufficient. ORE had been actively improving its security posture, had frozen its staking program for upgrades, and still ended up with an exploitable bug.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Institutions Reveal Changes in Oil Supply Pattern: US Sanctions Force Iran's Maritime Crude Exports to "Zero", Russian Exports Up 6% MoM
According to Vortexa data, Iran's seaborne crude oil exports have remained at zero since dropping in the second week of September and had not resumed as of October 5. The total amount of Iranian crude oil stranded on offshore tankers has decreased to about 83 million barrels, with around 43 million barrels trapped west of the Strait of Hormuz, making export difficult due to the US blockade. Excluding Iran, the crude oil flow in the Gulf region in September has recovered to over 81% of pre-war levels, mainly driven by the recovery of Saudi exports.
President of New York Federal Reserve, Williams: May raise interest rates once more within the year, no need for further tightening in 2027
John Williams, President of the Federal Reserve Bank of New York, said on Tuesday that he still considers it appropriate for the Federal Reserve to raise interest rates once more this year, but currently does not believe that the central bank needs to further increase rates in 2027.
Risks to Middle Eastern energy facilities escalate as Saudi Aramco headquarters reportedly hit and set on fire by Houthi forces
According to reports, during a missile attack launched by Yemen's Houthi forces against Saudi Arabia on Tuesday, the headquarters of Saudi Aramco in Dhahran was hit, causing a fire in part of the complex, which was later extinguished. It could not be confirmed whether the fire was caused by a direct missile hit. The Saudi government and Saudi Aramco have not confirmed reports of an attack on the headquarters.
Crypto prices
More
