[SIP1.8] (July 6th Exploit Followup) USDC Higher Risk (Ethereum) Vault Cleanup and Market Withdrawals

Governance Summer Improvement Proposals [SIPs]
, , ,
1

1. Overview:

On July 6, 2026, an attacker manipulated the share price of two Lazy Summer Protocol USDC vaults on Ethereum mainnet and extracted approximately $6.04 million of depositor value in a single atomic transaction.

This SIP is in response to the RFC and voting outcome by community members on what to do next with the affected Vaults.

This SIP performs the following to the Higher Risk USDC Vault;

  • Grants keeper role to governance
  • Unpauses the Vault
  • Removes all arks that had their deposit caps set to 0 and have no allocated funds.
  • Requests withdrawal of all funds deposited in Origin
  • Revokes Keeper Role
  • Set TipRate to 0
  • Pauses the Vault

2. Motivation:

After the exploit, there remains around 278,000 USDC deposited through Term Finance connector to the Lower Risk Vault and Origin Protocol. This SIP is the first step to recovering these assets for the users that had deposited into the strategy.

Because the attacker still has shares in the Vault, and the community within the SIP voted to remove their shares, the Vault is going to remain paused, and follow-up SIPs will move the funds to MERKL to allow them to become claimable there, with a snapshot taken the block after the attack.

3. Specification:

Created on the base hub and relayed via LayerZero to the mainnet timelock 0x447BF9d1485ABDc4C1778025DfdfbE8b894C3796 for execution.

Actions

  1. PAM.grantKeeperRole(OriginUSD-usdc-1 ark, executor) — ark-scoped, for requestWithdrawal
  2. FleetCommander(LazyVault_HigherRisk_USDC).unpause() — not before 2026-07-08T10:25:35.000Z
  3. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Fluid-usdc-1)
  4. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Yield-usdc-1)
  5. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Swaap_Lend-usdc-1)
  6. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Resolv-usdc-1)
  7. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Stablecoin_Maxi-usdc-1)
  8. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Gauntlet_Frontier_USDC-1)
  9. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Relend_USDC-1)
  10. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-MEV_Capital_USDC-1)
  11. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(Syrup-usdc-1)
  12. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(SiloManagedVault-apostro-usdc-1)
  13. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Gearbox_Invariant-usdc-1)
  14. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Avantgarde_USDC_Core-1)
  15. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Gauntlet_USDC_RWA-1)
  16. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-MEV_Capital_PTs_USDC-1)
  17. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-RE7_USDC_FX_Protocol-1)
  18. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Steakhouse_InfiniFi_USDC-1)
  19. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-TAC_USDC-1)
  20. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Clearstar_USDC_Reactor-1)
  21. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoVault-usdc-Edge_UltraYield_USDC-1)
  22. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Frontier_Falcon-usdc-1)
  23. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Frontier_MMEV-usdc-1)
  24. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Frontier_YieldFi-usdc-1)
  25. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Frontier_Hyperwave-usdc-1)
  26. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Frontier_Yala-usdc-1)
  27. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Euler_Frontier_Pareto-usdc-1)
  28. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(SiUSDArk-usdc-1)
  29. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(FluidFToken-usdc-1)
  30. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Morpho_V2_Yearn_OG_USDC_v2-usdc-1)
  31. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(ERC4626-Morpho_V2_Hyperithm_USDC_Midcurve-usdc-1)
  32. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoV2Vault-usdc-Yearn_OG_USDC_v2-1)
  33. FleetCommander(LazyVault_HigherRisk_USDC).removeArk(MorphoV2Vault-usdc-Hyperithm_USDC_Midcurve-1)
  34. OriginUSD-usdc-1.requestWithdrawal(max) — async redemption of the full position
  35. PAM.revokeKeeperRole(OriginUSD-usdc-1 ark, executor) — cleanup (re-granted in the follow-up)
  36. FleetCommander(LazyVault_HigherRisk_USDC).setTipRate(0) — cleanup default
  37. FleetCommander(LazyVault_HigherRisk_USDC).pause() — restore paused state (restarts the minimum pause window)

4. Risk Assessment:

Because the Vault will be unpaused and re-paused at the end of the actions, there is not expected to be any increased risk exposure to the Vault or the Protocol. When the funds arrive back into the Vault, another governance SIP will be proposed to handle the funds further.

5. Voting:

Voting YES will execute the proposal and remove 31 arks/markets from the Vault which have a deposit cap set to 0 and no funds allocated to them, and request withdrawal from the Syrup ark. Voting NO will not execute any code, the Vault will remain paused and no funds will be requested for withdrawal from any markets.

1 Like