ORE smart contract bug let attacker drain 25.5 SOL from staking program
A smart contract vulnerability in ORE’s staking program allowed an attacker to improperly claim 25.5 SOL, roughly $2,125, from the protocol’s yield mechanism. The exploit was disclosed on June 17, and while the dollar amount is modest by crypto exploit standards, the incident forced ORE to require all stakers to migrate to an entirely new contract before they can start earning rewards again.
What happened and what ORE is doing about it
ORE is a proof-of-work mining protocol built on the Solana blockchain. The protocol allows miners to stake either SOL or ORE tokens and earn yield generated through protocol revenue, not through token inflation.
The bug in question was located within the staking program’s smart contract. It gave an attacker the ability to claim yield they weren’t entitled to. The protocol has confirmed that user deposits themselves remain secure, meaning the vulnerability was isolated to the yield distribution mechanism rather than the underlying staked assets.
On May 29, about three weeks prior to the disclosure, the protocol froze its staking program as part of a broader security upgrade. That initiative was aimed at permanently locking the contract policy to eliminate potential upgrade authority risks, essentially removing the ability for anyone, including the team, to modify the contract after deployment.
The fix requires stakers to migrate to a new smart contract. Until they do, yield accumulation is paused. No timeline has been publicly shared for how long the migration window will remain open or when a full post-mortem analysis will be published.
What this means for stakers and investors
For current ORE stakers, the immediate action item is clear: migrate to the new contract. Failing to do so means sitting on assets that aren’t generating any yield.
ORE has undergone several iterations since it first launched in early 2024. The protocol communicated the breach primarily through social media, and detailed information regarding the attacker or a comprehensive post-mortem analysis remains undisclosed.
The vulnerability here was in ORE’s staking logic, not in Solana’s infrastructure. Investors evaluating smaller DeFi protocols should treat this as a case study in why audit reports are necessary but not sufficient. ORE had been actively improving its security posture, had frozen its staking program for upgrades, and still ended up with an exploitable bug.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
SoftBank reports first quarterly loss in two years! $3.7 billion impairment in US data center project, AI investments face pressure
SoftBank Group reported a net loss of 1.12 trillion yen in its second fiscal quarter, marking its first quarterly loss in nearly two years. The main reasons are the write-off of nearly $3.7 billion in advance payments due to adjustments in the procurement of power supply equipment for its AI data center in Ohio, USA, a shift of the Vision Fund from profit to loss, and a surge in the cost of high-debt financing. Since the June peak, SoftBank's share price has fallen more than 50%.
Expanding computing power on one hand, grabbing spectrum on the other! Barclays optimistic about SpaceX (SPCX.US) acquiring T-Mobile: Complementary advantages of ground networks and Starlink
After Space's stock price rose for two consecutive days, Barclays stated that T-Mobile is the "cleanest" choice among SpaceX’s potential acquisition targets. Barclays considers Verizon a major unknown, while AT&T has the lowest strategic fit.
Will the Federal Reserve raise rates in December? Tonight's CPI will be the final verdict!
The October CPI data will be released tonight, with the market pricing in an 86% chance of a rate hike. Goldman Sachs predicts a core CPI month-on-month increase of only 0.16%, much lower than market expectations. However, statistical distortions in health insurance and declines in used car prices—these "soft factors"—are unlikely to be reflected in the core PCE, which the Federal Reserve places greater emphasis on. The data may trigger a relief rally, but it is unlikely to change the underlying hawkish sentiment.
A 14x PE is not a bargain! Renowned wealth management CEO warns: If Nvidia (NVDA.US) earnings are revised down by 5%, its stock price could drop by 40%.
Ritholtz Wealth Management CEO Josh Brown questioned the idea that a 14x P/E ratio is a bargain and issued a warning: "If Nvidia's earnings over the next 12 months are revised down by 5% from our expectations, the stock could potentially drop by 40%."
Crypto prices
More
