Solana Neobank Avici Hacked for $500k via Rain Contract Flaw

A security flaw in Solana's Rain card infrastructure allowed an attacker to drain over $500k from 1,685 Avici users. The exploit started when a wallet was created with just enough funds for gas and then executed a tightly sequenced series of transactions, draining card balances.

The attack used a vulnerability in an outdated version of the Solana card contract, which Rain had identified but not addressed until after the incident. Avici has confirmed that every affected user will receive a full refund and has filed a report with the FBI's IC3.

Security researchers have criticized the use of single-key upgrade authorities for smart contracts, citing it as a major contributor to the exploit's success.