Cashio’s stablecoin devalues after attack

The Cashio protocol on Solana was attacked. The price of the CASH stablecoin fell to zero, and the project’s TVL declined by $28 million.

Please do not mint any CASH. There is an infinite mint glitch.

We are investigating the issue and we believe we have found the root cause. Please withdraw your funds from pools. We will publish a postmortem ASAP.

— Cashio ($CASH) 💵 (@CashioApp) March 23, 2022

“Please do not mint any CASH. There is an infinite mint glitch. We are examining the issue and believe we have found the root cause. Please withdraw your funds from pools,” the project team wrote.

The developers promised to disclose details later.

CASH is a dollar-pegged algorithmic stablecoin, issued by the protocol backed by USDT and USDC on a DEX Sabre. The asset can be exchanged for liquidity tokens on the platform to participate in yield farming.

The vulnerability identified by the team allows minting an unlimited number of tokens, usually without any collateral. An attacker can sell the coins, exerting downward pressure on the asset’s price.

According to the blockchain explorer, an unknown actor minted 2 billion CASH, paying a fee of 0.000005 SOL (~$0.00046).

According to CoinGecko, after the incident the CASH price collapsed to around $0.00006. In the last 24 hours, trading volume was around $17.3 million.

DeFi Llama recorded a drop in TVL from $28.87 million to $578,610.

Earlier in 2021, the DeFi protocol Safe Dollar on the Polygon blockchain was subjected to a similar attack. The price of the dollar-pegged algorithmic stablecoin SDO also fell to zero.