Haedal, a capital-efficiency layer protocol on Sui, released a post-incident analysis of a security event affecting Haedal Vault, estimating direct losses at about $915,179. According to Foresight News, Haedal said it will cover all user losses in full and affected users will receive complete compensation.
In its report, Haedal said the root cause was a hidden cross-version logic flaw introduced during a Vault contract upgrade deployed at the end of last year. After the new software package was released, the old entry point was not forcibly deprecated and remained callable.
Haedal said the attacker used the old deposit path to over-mint Vault LP shares and then redeemed them for underlying assets. The old version, new version, and the upgrade had all passed audits, but the issue was not identified when each version was reviewed separately.
Haedal said the problem was limited to Haedal Vault and that other products, modules, and assets were not affected. The team said it is developing a fix that will undergo re-auditing and multiple reviews before upgrading and restoring the service. Haedal added it is coordinating with partners to trace the funds and investigate the attacker.
Anais
