Rain Card vulnerability costs Solana users $1.1 million

Principle of exploit

This attack originated from the fact that the Rain Solana contract version was too old, resulting in unauthorized fund withdrawal vulnerabilities in card mortgage accounts of multiple projects. Blockaid, a blockchain security company, estimated that the stolen amount was approximately $1.1 million, and the funds were then transferred to a Tornado Cash mixer on the Ethereum network.

This outdated contract requires two independent approvals before a specific operation is performed and uses Solana's Ed25519 verification system to check the signature. However, Blockaid found that the attacker circumvented the dual approval requirement by reusing one of the signatures to make it look like two separate approvals and could operate without the account owner's permission.

After bypassing security checks, the attacker granted himself administrator privileges on various accounts and extracted USDC and USDT stablecoins from those accounts. Blockaid recorded 2,945 administrator privilege additions and 5,288 withdrawal calls. In total, 8,233 exploit transactions occurred in approximately 2 hours and 29 minutes. The first two withdrawals were only three seconds apart, a rhythm that suggests the attacker built an automated system to quickly target large numbers of accounts.

Fund destination and scope of influence

The stolen stablecoins are first sent to a Solana wallet, which is then exchanged for SOL through a decentralized exchange. Blockaid traces show that funds were transferred from Solana to Ethereum through the deBridge cross-chain protocol. Between 19:20 and 19:49 Coordinated Universal Time (UTC), approximately 455.9 ETH entered Tornado Cash. Because Tornado Cash has a currency mixing function, it is difficult to trace withdrawals back to the original wallet. As of the release of the report, the funds have not been recovered.

There are two Ethereum addresses linked to the sources of funding for the attacker's early activities on Solana. Currently, neither Rain nor law enforcement agencies have disclosed the identity of the controllers of these addresses.

The specific affected projects and losses are as follows:

• Avici: A total of 1,685 users had funds stolen, totaling US$500,859. The company has made full refunds to all affected customers and provided an additional 10% cash refund.
• Tria: A total of 636 customers were affected, resulting in a loss of approximately US$431,945. The company said it would compensate each customer.
• Solayer Pay: is also listed as one of the affected projects, but there is no confirmed loss data.

It is worth noting that there is a gap between the total disclosed losses and Blockaid's estimate of US$1.1 million, a difference that has not yet been fully explained. In addition, since the encryption news broke, the Avici token price has fallen 49% from its intraday high, and has rebounded after hitting a low of $0.217; the Tria token has also fallen more than 10% at one point.

Incident follow-up and statement

Rain stated that all projects using this vulnerability contract version have been upgraded to the latest security version. No further unauthorized activity has been identified since the update was completed.

Rain emphasized that the infrastructure it provides allows cryptocurrency companies to issue cards funded by stablecoins. Customer deposits go into mortgage accounts controlled by on-chain contracts, which are independent of the user's personal wallet, and whose security relies on codes and controls set up by the infrastructure provider. The attack targeted independent contracts holding top-up balances, so users using self-managed wallets were not affected.

Although Rain has confirmed that all affected programs have been upgraded, as of now, the company has not released a complete technical report, nor has it explained why the old contract is still running, or whether the vulnerability was discovered through an audit before the attack occurred.