Garden Finance shut down its application following a $450,000 exploit discovered by security firm Blockaid. The attack targeted an independent solver's off-chain database, not Garden Finance's core infrastructure or user assets.
An attacker gained access to the solver's database and injected fraudulent swap records into the system. This allowed the attacker to execute unauthorized transactions that drained approximately $450,000 in value. Garden Finance emphasized that no user funds or smart contracts were directly compromised by the breach.
The Garden Finance team disabled the app immediately upon discovering the exploit. This decision protected remaining user assets from further exposure while the team investigates the full scope of the incident. Blockaid's detection and reporting of the vulnerability proved critical in preventing larger losses.
The exploit reveals a vulnerability in the decentralized finance architecture that Garden Finance deployed. While the core smart contracts remained secure, the reliance on a third-party solver with off-chain database access created an attack surface. The attacker exploited weak access controls or compromised credentials to insert malicious swap records that appeared legitimate to the protocol.
This incident follows a pattern seen across DeFi protocols where seemingly peripheral systems become critical security chokepoints. Off-chain databases, oracles, and relayers often lack the same security rigor as on-chain code audits. Garden Finance's architecture depended on solver integrity and database security, assumptions that proved flawed.
The protocol must now audit the solver relationship, implement stronger database access controls, and potentially redesign how swap records are validated. Multi-signature verification and encryption for off-chain data could prevent similar attacks.
Garden Finance operates as a decentralized protocol, but the exploit underscores that DeFi security extends beyond smart contract code. Infrastructure dependencies require equal scrutiny. The $450,000 loss serves as a reminder that attackers target the weakest link in the chain, often finding it in operational systems rather than cryptography.