On July 13, 2026, Lumi Finance on Arbitrum lost ~$270K through Sodium smart account ERC-1271 validation flaws. The exploit required two bugs: (1) Sodium accepted attacker-controlled contracts as valid signers and session keys, and (2) validateUserOp granted unlimited ERC-20 allowances via attacker-controlled paymasterAndData. Attackers systematically stripped tokens from user accounts, leaving persistent allowances.

The DeFi protocol Lumi Finance on Arbitrum suffered an exploit where attackers leveraged Sodium smart accounts that performed token approvals as a side effect during UserOp validation. This allowed a malicious Paymaster to gain allowances from multiple accounts and drain funds, resulting in approximately $270,000 in losses.