Hello everyone.
Today we’d like to share a story about what can happen inside large crypto projects when their complexity starts outpacing their ability to respond. This isn’t fiction — it’s a real case from the Solana ecosystem involving its largest staking protocol, Marinade.
And it raises a crucial question:
Where exactly is the line between a “systemic inefficiency” and an “exploited vulnerability”?
How It Started
After we — the Shiroi team — learned that certain validators had discovered and begun exploiting a weakness in Marinade’s auction system, we decided to run our own independent audit.
Our goal was simple: to understand the scale of the damage.
The results were unexpected.
Over 126 epochs, the Marinade protocol lost at least 37,000 SOL — equivalent to more than $5 million USD at current prices.
We also calculated the percentage of stake left unpaid by validators each epoch.
It ranged from 2% to 75%, with an average of 28% unpaid stake across 124 epochs.
What Does That Mean?
In essence:
- Honest validators were subsidizing “free stake” for the exploiters.
- Stakers who trusted the system missed out on up to 28% of their advertised APY.
Key Figures
The Top 10 loss-heavy epochs showed missed rewards between 685 and 886 SOL per epoch.
The Top 10 validators responsible for the largest impact exploited the vulnerability for sums between 595 and 1,081 SOL in total.
To put it simply:
During the worst epoch, Marinade and its stakers collectively missed out on at least 886 SOL in rewards.
And the most “resourceful” validator managed to profit by more than 1,081 SOL over the lifetime of this exploit.
Not a bad side income for 126 epochs, is it?
We also identified 24 epochs in which more than 50% of all stake went unpaid — epochs 652–658, 755–757, and 764–777.
Marinade’s Response
Following the publication of our findings, the Marinade team released an official statement.
Their position can be summarized as follows:
- Marinade only reports realized APY — actual user returns, not theoretical estimates or validator bid expectations.
- The 37,000 SOL figure refers to missed rewards, not direct losses.
- No user funds were ever at risk, and no SOL was “stolen” from stakers.
According to Marinade, a small number of validators did indeed lower their bids after winning auction allocations — behavior that wasn’t intended or incentivized.
A fix is already live: a bid-reduction penalty now slashes rewards for validators who try to undercut their original bids.
More than 500 SOL has already been redistributed to stakers through this mechanism.
To provide context, Marinade shared aggregate figures for the same 126-epoch window:
- 93,000 SOL from validator bids
- 420,000 SOL from inflation rewards
- 80,000 SOL from MEV
- 2,000 SOL from PSR penalties
That’s roughly 595,000 SOL in total rewards.
By their calculation, the identified inefficiency represents about 6% of that total — “not zero, but far from catastrophic.”
The Protocol’s Evolution
Marinade emphasized that its Stake Auction Mechanism (SAM) was never meant to be perfect from day one — it evolves with validator behavior and network data.
In response to these findings, the team says it is:
- Developing a validator reputation system to reward reliable operators
- Improving unstake-priority logic
- Testing auction updates to ensure honest validators earn more
They also noted that MEV existed on Solana long before SAM, and Marinade merely introduced a way to redirect part of that value to stakers.
In their words, this isn’t an exploit — it’s “value alignment.”
What It All Means
Formally, no one lost funds.
Practically, millions of dollars in unrealized rewards remained between the lines of the system.
One can debate whether to call it a “loss” or an “inefficiency.”
But what truly matters is this:Every auction-based system is a living organism, constantly adapting to participant behavior. And when some players begin using that system against the very principle of transparency it was built on — it’s time to ask the hard question:
At what point does “unintended optimization” turn into “exploitation”?
