Solv Protocol exploited for $2.7M through smart contract minting vulnerability.
Security & Exploits ·
Solv Protocol sustained a $2.7 million exploit due to a double-minting vulnerability in its BitcoinReserveOffering contract, identified as BRO-SOLV-20MAY2026. The flaw existed in the mint function, which triggered token issuance twice when a user minted by transferring a full ERC-3525 NFT—once through the onERC721Received callback and again through the mint function itself, allowing the same amount to be credited twice.
The attacker exploited this by repeating a burn-to-mint sequence 22 times, converting an initial 135 BRO tokens into 567 million BRO. The inflated supply was then exchanged for approximately 38 SolvBTC, equivalent to roughly $2.73 million in value, through Solv's exchange contract. Transaction details and the victim contract address were documented in the initial report.
The exact scope of ongoing impact and whether the vulnerability has been patched remain unclear. The mechanism allowed systematic token multiplication through a callback-based re-entry pattern, highlighting a design flaw in how the protocol handled sequential transfers and minting operations.