The Solana Ecocard project Avici recently experienced the use of contractual loopholes. The chain data show that the attackers first transferred about $190 US$ USDDC to the new wallet to pay for the fees, and then initiated operations on the Solana card contract in Avici, which cumulatively transferred over $670,000. As more accounts were accessed, Platform-related losses at one time exceeded $1 million.

The attack continued close to 9000 transactions.

The attack wallet was silent for about three hours after the initial infusion, and then started interacting with the Solana card contract in Avici at 16:49 UTC. The first large-scale transfers occurred between 18:19 and 18:34 UTC, amounting to approximately $576 million.

Since then, the attacks have continued to expand, bringing the cumulative number of transactions to 8,857. The chain data also show that the assailants draw the balance on an account-by-account basis, rather than transferring the full amount of funds once.

The loophole points to the card balance contract.

Avici claimed that the incident did not affect the main vault or involve the theft of the upgraded key. Problems arise in the validity of individual user card balance contracts.

The report mentions that the loophole relates to the infrastructure provided by the Avici issuing card partner Rain and involves an outdated signature and authority check logic. By constructing a signature package called AddCollateral Admin, the attackers had wrongly obtained administrator privileges for more than 1,100 user mortgage accounts and then withdrew funds one by one.

The median number of individual withdrawals in the disclosed sample was approximately $24, the largest being $5,268.

Team says it's repaired and added back

Avici states that the affected balances have been restored in full and that an additional 10 per cent is provided for repatriation at the amount transferred. The team claims that this loophole affects only the Solana card contract balance, which is fully valued through Top Up.

At the same time, Avici states that regular Solana wallets, EVM wallets, EVM card balances, as well as gold, gold and exchange functions, have not been affected. The team continues to monitor the renewed contracts on an ongoing basis and to require users to reconcile recovered balances.