A vulnerability in a version of Rain’s Solana card contract used by Avici allowed unauthorized withdrawals from the contract holding users’ card balances. Avici reported that 1,685 users were affected for $500,859.22. The vulnerable contract was subsequently upgraded across all affected programs

Attackers exploited a vulnerability in an outdated version of Rain’s Solana card contract used by Avici (and a few other programs). By submitting crafted signature bundles to gain unauthorized admin rights via AddCollateralAdmin and then withdrawing collateral, they drained $500,859.22 from 1,685 users’ card balances. Self-custodial wallets were unaffected. The contract was upgraded across all programs, and full refunds were promised.