Sui DeFi Protocol Full Sail Winds Down After $91K Exploit

The decentralized finance (DeFi) protocol Full Sail, operating on the Sui blockchain, announced its decision to wind down operations on May 22, 2024, following a security incident. The exploit, which occurred on May 21, 2024, resulted in the loss of approximately $91,000 across three of Full Sail's vaults. The protocol's team stated that the attack was linked to an issue with the oracle provider, Switchboard. In a post on X (formerly Twitter), Full Sail detailed that the attacker exploited a vulnerability to drain funds from its vaults. The team confirmed that the exploit was not due to a smart contract bug within Full Sail itself but rather an external dependency. Specifically, the vulnerability stemmed from the way Switchboard's oracle data was being utilized by Full Sail's vaults. The attacker was able to manipulate the price feeds or data provided by Switchboard to execute the fraudulent transactions. Full Sail's vaults affected were those that relied on Switchboard's oracle for asset pricing and liquidation mechanisms. The total amount stolen, reported as around $91,000, was distributed across these three vaults. Following the incident, Full Sail's leadership concluded that continuing operations would be untenable due to the loss of user trust and the potential for further risks. The decision to wind down means that Full Sail will cease all active development and support, and will work towards returning any remaining assets to its users in an orderly fashion. The Sui blockchain is a layer-1 blockchain developed by Mysten Labs, designed for high throughput and low latency, aiming to support a wide range of decentralized applications, including DeFi. Oracles, such as Switchboard, play a critical role in DeFi by providing external data, like asset prices, to smart contracts, enabling them to execute trades, liquidations, and other functions. Security incidents involving oracles can have significant cascading effects on DeFi protocols that depend on them. The incident highlights the ongoing security challenges within the DeFi ecosystem, where the interconnectedness of protocols and reliance on third-party services can create systemic risks. Full Sail's shutdown serves as a cautionary tale for other DeFi projects regarding the importance of robust security audits and diversified oracle solutions. The team has committed to transparency throughout the winding-down process and will provide further updates on asset distribution.