Scallop exploit drains 150K SUI funds

Scallop lost around 150,000 SUI after an attacker exploited a deprecated rewards contract linked to its sSUI incentive mechanism.

The exploit targeted a peripheral contract rather than core lending pools, with user deposits remaining unaffected and protocol operations resuming within two hours.

“Scallop will fully cover 100% of the loss,”

The team said in a public statement following the incident.

The vulnerability stemmed from an outdated V2 spool contract released in November 2023, where an uninitialised reward index allowed the attacker to claim inflated rewards.

On-chain analysis showed the attacker staked roughly 136,000 sSUI and exploited a reward index that had accumulated over time, enabling the withdrawal of approximately 150,000 SUI.

The incident follows similar attacks across the Sui Network ecosystem, including a recent exploit at Volo Protocol, highlighting risks in peripheral smart contracts rather than core systems.

Despite the breach, Scallop confirmed it will absorb the losses without impacting users, as scrutiny grows on legacy code and contract versioning practices in DeFi.

At the time of reporting, Sui price was $0.9449.