Cashio Money

Summary

Cashio was a decentralized, algorithmic stablecoin ("CASH") built on Solana, pitched as similar in design to Abracadabra's MIM: instead of taking raw stablecoins as collateral, it let users deposit interest-bearing Saber USD liquidity-provider (LP) tokens (pools such as USDC/USDT, USDC/UST) and mint CASH against them, aiming to keep CASH pegged to $1 while letting depositors keep earning Saber swap fees on their underlying collateral. In March 2022, an attacker discovered that Cashio's collateral-validation logic never actually checked that the token mint associated with a deposited "bank" account matched a real, legitimate Saber LP mint. By fabricating a worthless SPL token and a fake bank/collateral account, the attacker minted roughly 2 billion CASH out of thin air and cashed out about $52.8 million in real assets (USDC, USDT, and UST) before the protocol's peg collapsed to near zero. Cashio had not undergone a third-party smart-contract audit prior to the exploit.

Design (Mechanism)

Cashio's core mechanic was a "Saber Loans" style crate system: users deposited Saber USD LP tokens into a program-controlled vault ("crate"), and the protocol minted CASH 1:1 (minus fees/collateral ratio buffers) against the deposited value. Because the collateral was itself an interest-bearing LP position, depositors continued to earn Saber trading fees on their underlying stablecoins while simultaneously holding liquid CASH, which could be used elsewhere in Solana DeFi. The system depended on a chain of account checks to make sure that (1) the token being deposited was a genuine Saber LP token for an approved pool, (2) the bank account receiving that deposit matched the token type being minted against, and (3) redemptions burned CASH and returned the correct underlying collateral. The design intentionally avoided pure algorithmic/undercollateralized mechanics (unlike, e.g., early UST) by requiring real LP-token backing — the failure was not in the economic model but in the account-validation code enforcing it.

Outcome

On March 23, 2022, an attacker exploited a gap in the crate_collateral_tokens validation logic: the program checked that a deposited token matched a general pattern for Saber Swap LP tokens but never verified that the specific mint field on the saber_swap.arrow account was legitimate, and separately failed to confirm that the token type registered on the collateral "bank" matched the token actually being minted. This let the attacker create a fake, worthless token, wrap it in a fabricated bank/collateral account, and use it to mint approximately 2 billion CASH. The attacker then redeemed/swapped a portion of this fake CASH for real collateral and dumped the rest on decentralized exchanges, extracting roughly $52.8 million (reported as a mix of USDC, USDT, and UST). Cashio's total value locked collapsed from about $28.9 million to under $600,000, and CASH's price fell from $1 to roughly $0.00005, effectively ending the protocol. The attacker left an on-chain message pledging to return funds to victims holding under 100,000 tokens and to donate the remainder to charity; multiple outlets reported partial refunds followed, though the exact final recovered amount is Unknown / not found. No prosecution or identification of the attacker has been publicly confirmed.

Why it worked

• The LP-token-collateral concept itself was reasonable and had a working precedent (Abracadabra-style vaults), so the protocol attracted meaningful TVL (tens of millions) quickly by offering yield-bearing collateral.
• The composability of Solana DeFi (Saber pools plus a minting layer) let Cashio bootstrap liquidity fast without needing its own primary liquidity.

Where the design broke

• The protocol shipped without a completed third-party security audit, and its account-validation logic contained a critical gap: it never verified that a deposited "collateral" account's token mint genuinely matched an approved Saber LP token, nor that the bank's registered token matched the token being minted against.
• This missing check meant the "collateralized" stablecoin could be minted against entirely fake, valueless collateral — a class of bug (SPL account/mint confusion) that was already a known risk pattern on Solana.
• Once the exploit executed, the peg break was instant and total: because CASH is fungible, 2 billion illegitimately minted tokens immediately diluted and effectively destroyed the value of all legitimately-backed CASH in circulation.

Lessons

• On Solana (and any account-model chain), every program that accepts a token account as "collateral" must explicitly verify the account's mint field against an allow-list — implicit trust in account shape rather than verified identity is a recurring exploit class.
• Composability that lets a protocol accept another protocol's LP tokens as collateral inherits that protocol's complexity and multiplies the attack surface; each additional hop (Saber pool -> LP token -> Cashio bank -> CASH mint) needs its own validation.
• Launching a stablecoin protocol that can mint against user-supplied collateral without a completed, published third-party audit is a materially higher-risk decision, especially when the token is designed to be as fungible and liquid as a "stable" asset — a single validation gap can destroy the entire supply instantly rather than degrading gracefully.
• Public, on-chain attacker messages promising partial refunds highlight that exploit "outcomes" in DeFi are often messy and partially mitigated after the fact, but this does not restore trust or relaunch a stablecoin's peg.

Redesign (EDITORIAL)

EDITORIAL / hypothesis, not fact: A more defensible version of Cashio would have (1) required a completed, public third-party audit plus a live bug-bounty program before allowing any collateral deposits above a small TVL cap, consistent with how many later Solana stablecoin projects gated growth; (2) implemented an explicit, hard-coded allow-list of approved Saber LP mint addresses at the program level (rather than pattern-matching account structure), so any token that wasn't on the list would be rejected outright regardless of how convincingly it mimicked a real LP token; and (3) used a circuit-breaker/mint-rate-limiter that would halt minting automatically if CASH supply grew by an anomalous amount (e.g., more than X% of existing supply) within a single block or short window, which would have capped the 2-billion-token mint to a much smaller, more survivable loss and given the team time to pause the program before the attacker could cash out.