On June 25, 2026, Lixir Finance vaults were exploited via insufficient nonce validation in permit() function. Attacker reused a single non-owner signature across 41 calls on six vault clones to gain allowances and extract USDC, USDT, ETH, and LIX tokens.

Lixir Finance's vault tokens (lv_* wrappers over Uniswap V3 LP positions) were exploited due to a broken EIP-2612 permit signature verification. The attacker reused a single dummy signature to bypass checks, granting approval to their contract over dozens of holders' tokens, then drained underlying assets (WETH, USDC, USDT, LIX) via withdrawFrom/withdrawETHFrom, resulting in ~$12,300 loss.