CometDEX’s Soroban AMM allowed same-asset swaps such as USDC→USDC. When token_in and token_out were identical, the contract loaded two independent copies of the same reserve record, added the input amount to one copy and subtracted the output from the other, then wrote both back to the same map key. The second write overwrote the first, causing the pool’s recorded reserve to fall below its actual token balance. The attacker then deposited against the understated reserve, received excess LP shares, and redeemed those shares for real pool assets. The cycle was repeated 36 times using flash liquidity. Blend contracts themselves were not exploited, but Blend Backstop depositors were exposed because the backstop held BLND/USDC Comet LP shares

The BLND-USDC liquidity pool of CometDEX (Comet AMM) on the Stellar network was exploited due to an accounting bug that allowed same-asset swaps (USDC→USDC), corrupting reserve calculations. The attacker used flash loans from a Blend pool and repeated the process about 36 times to extract excess funds, resulting in a loss of approximately $717,518.92 USDC. Funds were subsequently moved.