Cashio

Cashio operates as a Solana-based decentralized finance protocol that issues the CASH token. Users can deposit liquidity provider (LP) tokens as collateral to mint CASH, enabling lending and borrowing activities on the Solana blockchain. The protocol also includes a bridging function that allows assets to be transferred between Solana and Ethereum.

On March 23, 2022, an attacker exploited an infinite mint vulnerability in the protocol by bypassing incomplete collateral validation checks. The exploit involved using unverified LP token mint fields to deposit fake collateral, which permitted the minting of 2 billion CASH tokens. These newly minted CASH tokens were subsequently swapped for approximately $36.2 million in UST and USDC stablecoins. The stablecoins were then bridged to Ethereum, resulting in over 16,000 ETH being moved, valued at about $48 million.

Following the exploit, the attacker refunded smaller impacted accounts that held less than 100,000 dollars in value. The attacker claimed that the remaining funds would be donated to charity. Cashio advised its users to withdraw any remaining assets from the protocol as a precautionary measure. The protocol publicly acknowledged the incident and stated that a root cause investigation was underway.

Cashio's distinguishing attributes include its reliance on LP token mint fields for collateral validation and its built‑in cross‑chain bridging capability between Solana and Ethereum. This combination positions the protocol within the Solana DeFi sector as a provider of a stablecoin‑like asset that can be moved across chains. No explicit information about the organisation's ownership, parent company, or subsidiary structure is available in the provided sources. The protocol's headquarters is located in the United States of America.