Garden Finance has disabled its decentralized exchange app following an incident reported by security firm Blockaid. The platform says no user funds or smart contracts were affected after attackers compromised a solver’s off-chain database and inserted fraudulent swap records.
According to Cointelegraph reporting, the $450,000 figure mentioned represents either unrealized exposure from unauthorized orders rather than actual theft—because attacker wallets don’t actually receive stolen on-chain transfers when contract-level protections prevent funds movement beyond a compromised validation layer. This distinction is economically significant for investors and victims of such incidents.
MEV (maximal extractable value) protocols commonly use independent solvers that submit price improvement orders without full smart-contract verification before execution—a design choice meant to lower latency but introduces database-level attack vectors like what Blockaid identified in this Garden Finance incident. The off-chain order book acts as a front-end interface where data integrity issues can exist even if core contract logic remains untouched.
Garden Finance’s team has implemented additional validation checks on solver-submitted orders and rate limiting for incoming arbitrage requests. They’ve also begun auditing their order routing architecture to prevent similar database injection scenarios from being possible in the first place.
The decentralized exchange app remains offline while engineers audit mitigations before relisting swap functionality for community users across all supported networks deployed by Garden Finance protocol maintainers and core developers.
