Avici Exploit Exposes Flaw in Solana Card Contract, 1,685 Users Affected

A vulnerability in the @avici Solana card contract has resulted in significant losses for thousands of users. An authorization flaw in the smart contract's signature verification system allowed an attacker to gain admin privileges.

The exploit affected 1,685 user accounts with a combined balance of $500,859.22. The attacker systematically drained funds, with a median loss of $24 per account and the largest single withdrawal reaching $5,268.

Avici has confirmed that all affected card balances will be fully reimbursed. The vulnerable contract has already been upgraded, and no unauthorized transactions have been recorded since the fix was implemented.