CometDEX

What happened

CometDEX’s Soroban AMM allowed same-asset swaps such as USDC→USDC. When token_in and token_out were identical, the contract loaded two independent copies of the same reserve record, added the input amount to one copy and subtracted the output from the other, then wrote both back to the same map key. The second write overwrote the first, causing the pool’s recorded reserve to fall below its actual token balance. The attacker then deposited against the understated reserve, received excess LP shares, and redeemed those shares for real pool assets. The cycle was repeated 36 times using flash liquidity. Blend contracts themselves were not exploited, but Blend Backstop depositors were exposed because the backstop held BLND/USDC Comet LP shares

Details

Date

Aug 25, 2026

Kind

Hack or exploit

Method

Incorrect Share Accounting

How in

Smart contract bug

Target

DeFi protocol

Chains

Stellar

Reported by

• DefiLlama ↗
• SlowMist Hacked ↗

Related incidents