Flash Trade, a Solana-based perpetuals exchange, suffered an unauthorized withdrawal of 98,000 USDC on July 22 at 00:21 SGT. The exploit was traced to a validation flaw in MagicBlock's SDK, which allowed an attacker to submit a fake account that bypassed undelegation checks.
The vulnerability existed inside the #[ephemeral] Anchor macro within the SDK. The macro failed to verify that the buffer used in an undelegation instruction matched the correct PDA seeds. This gap let the attacker's manufactured account pass as legitimate, triggering an invalid receipt and enabling the withdrawal.
Flash Trade's recently deployed batching and monitoring systems detected the activity within minutes. The platform immediately paused all deposits, withdrawals, and trading. Trading resumed quickly after the team investigated alongside MagicBlock, while deposits and withdrawals were restored after approximately 24 hours following a thorough fund reconciliation.
Both Flash Trade and MagicBlock confirmed they would jointly cover 100% of the affected deposits, with zero impact on user balances. A patched SDK version 0.16.2 was released to enforce the missing validation by default, and all integrators were urged to upgrade.
Industry figures like Backpack CEO Armani Ferrante weighed in on the incident, suggesting a structural solution involving isolated, formally verified custody contracts with 24-hour withdrawal timelocks to limit damage in similar exploits. He praised Flash Trade's swift response.
The event highlights ongoing security challenges in DeFi infrastructure, though the small amount and full user protection muted any long-term market impact.
