Huma Finance suffered a significant security breach when attackers exploited obsolete Polygon V1 BaseCreditPool contracts, draining about $101,400 by targeting flawed account validation logic. The vulnerability emerged in the refreshAccount() function, which incorrectly reclassified some accounts as “GoodStanding,” enabling unauthorized withdrawals through tightly coordinated transactions.
The majority of the stolen funds—over 82,000 USDC—came from a single Polygon V1 pool, with smaller amounts siphoned off from two additional pools. Crucially, funds held within Huma’s newer Solana-based V2 system remained unaffected since it operates independently from the compromised legacy contracts. This separation limited the overall damage to user assets on the protocol.
This incident highlights a persistent challenge in decentralized finance: dormant smart contracts and legacy code that remain publicly accessible continue to pose security threats even after development focus has shifted to upgraded platforms. In Huma’s case, functions such as requestCredit() and refreshAccount(), integral to older credit-state logic, were never fully disabled, allowing attackers to chain withdrawals across treasury-linked pools by exploiting fragile state transitions and complex fee calculations.
Huma Finance’s co-founder reflected on the breach as a “hard lesson” underscoring the necessity of retiring outdated contracts and simplifying infrastructure to reduce attack surfaces. While the protocol’s Solana-based architecture has processed over $13 billion in volume and currently supports substantial active liquidity, the lingering presence of Polygon V1 contracts reveals how technical debt can expand unnoticed as protocols prioritize feature growth over systematic infrastructure cleanup.
This exploit foregrounds a broader operational risk for DeFi ecosystems: the difficulty of securely sunsetting legacy contracts without residual permissions or hidden vulnerabilities. Projects that fail to fully decommission outdated modules risk undermining market trust and exposing themselves to unforeseen attacks despite ongoing innovation on newer chains.