Raydium core contributors: will fully compensate for stolen assets, the current mainnet program has not been affected

Raydium core contributor InfraRAY posted on platform X, stating that the team has confirmed that the old version of the AMM V3 program, which was previously discontinued in 2021, has been attacked. The attacker unauthorizedly removed part of the liquidity, but this incident does not affect current Raydium users, and the related liquidity pools have been unable to interact through the official Raydium UI since being disabled. The Raydium SDK and DApp also do not support operations on the mainnet old version AMM V3 liquidity pools.

The five affected liquidity pools include: Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL. Preliminary statistics show that the stolen assets include approximately 150,177 RAY, 5,603 SOL, and 893,700 USDC, with a total value of about $1.34 million. The related losses will be fully compensated by the treasury.

Investigations reveal that the vulnerability originated from insufficient verification of the LP token minting address. The attacker created new LP tokens and impersonated legitimate LP tokens, bypassing the protocol's ratio verification mechanism to extract funds. However, this incident is classified as an independent logical vulnerability and is not due to private key leakage or permission intrusion, and there is no risk of spread. Currently, all existing Raydium mainnet programs have not been affected.