{
  "id": 18588142,
  "title": "Loopscale: Pricing Misconfig and NAV Loan Exploit",
  "url": "https://urgent.news/2026/11/06/loopscale-pricing-misconfig-and-nav-loan-exploit",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T23:13:44.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/pandasecurity/loopscale-pricing-misconfig-and-nav-loan-exploit-1eok"
  },
  "original_language": "en",
  "account": "Loopscale, a Solana order-book lending protocol, halted its operations after a week-long campaign of malicious API traffic. The company disclosed two paths that led to the pause: a SOL Genesis Vault pricing misconfiguration and a USDC Genesis Vault NAV inflation attempt.\n\nPath 1:\nA misconfigured combination of asset-pricing parameters in the SOL Genesis Vault led to an undercollateralized loan of approximately $412K. The attacker exploited the misconfiguration by valuing collateral in the vault as a different asset. This resulted in a loan being sized off of incorrect price data, leaving the vault undercollateralized. The protocol halted the transaction after detecting the misconfiguration.\n\nPath 2:\nThe second path attempted an atomic transaction bundle sale into the USDC Genesis Vault. The attacker sold a loan carrying an extreme interest rate, which inflated the vault's Net Asset Value (NAV). This inflated NAV enabled a disproportionate redemption of approximately $521K. However, Loopscale's systems halted the redemption within 30 seconds, preventing any permanent loss to users.\n\nThe total economic exposure from these paths was roughly $412K of undercollateralized borrowing and a $521K attempted redemption that was stopped. Loopscale stated that affected vaults have been made whole, and no user deposits have incurred a loss. The restoration of priority lending, collateral top-ups, and repayments was completed, except for USDC Genesis Vault-funded loans. Vault withdrawals are still restricted.",
  "summary": "Originally published at Loopscale: Pricing Misconfig and NAV Loan Exploit On 5 November 2026 , Loopscale — a Solana order-book lending protocol built around fixed-rate, overcollateralized credit markets and Genesis Vaults — paused operations after a week-long campaign of malicious API traffic. The next day the team published a two-path disclosure: a SOL Genesis Vault pricing misconfiguration that…",
  "key_points": [
    "Loopscale halted operations due to malicious API traffic campaign",
    "Pricing misconfiguration in SOL Genesis Vault led to $412K undercollateralized loan",
    "USDC Genesis Vault NAV inflation attempt prevented $521K disproportionate redemption"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}