MARINADE FINANCE

DESCRIPTION OF EVENTS

Marinade Finance offers an institutional-grade staking platform on the Solana blockchain, delivering some of the highest yields in the ecosystem. Through its advanced delegation mechanism, it automatically allocates SOL across a curated list of top-performing validators, ensuring optimal returns while minimizing downtime risks. Currently boasting an impressive 9.17% APY, Marinade has over 10.6 million SOL in total value locked and is trusted by over 153,000 SOL holders. It’s also the first staking provider named in a U.S. Solana ETF filing, adding to its credibility.

Marinade offers two primary staking options: Native Staking, where users maintain full custody of their SOL, and Liquid Staking, which gives immediate access to liquidity through mSOL. Its Stake Auction Marketplace (SAM) allows validators to bid for delegated SOL, maximizing rewards and sharing priority fees. The Marinade Select program ensures users stake only with verified, institutional-grade validators, enhancing transparency and performance.

Security is a core pillar of the platform, featuring on-chain insurance against validator downtime, instant unstaking, and audited open-source code. Marinade is governed by a DAO powered by the MNDE token, allowing holders to participate in protocol decisions. With no venture capital funding and a minimum $15,000 bounty for security disclosures, Marinade emphasizes decentralization and community trust. Whether you're an individual staker or an institution, Marinade offers a robust, automated, and secure way to earn staking rewards on Solana.

Marinade Finance’s liquid staking platform, once hailed as a model of decentralized finance efficiency on Solana, has been deeply compromised by a critical design flaw — one that flipped the intended logic of its staking auction system and quietly funneled over 37,000 SOL (>$5 million) from mSOL holders to opportunistic validators over 126 epochs.

A technical issue at the heart of the Marinade Finance exploit lies in how unstake priority was incorrectly assigned due to a flawed sorting mechanism in the setStakeUnstakePriorities function. While the stake priority was properly determined by sorting validators in descending order of totalPmpe (protocol yield contribution), the unstake priority logic did the opposite of what was economically intended.

The flaw occurs specifically in Step 3 of the unstake priority assignment. Validators were sorted by stakeDiff in ascending order, but for many low-bid validators, stakeDiff defaulted to -1, meaning the array’s previous sorting — based on totalPmpe — remained mostly intact. This caused high-yield validators (high totalPmpe) to be assigned lower unstake priority values, making them the first to be unstaked, while low-bid, low-performing validators were allowed to remain staked longer — completely inverting the intended economic incentives.

Instead of rewarding high-contributing validators with delegation longevity, the system effectively penalized them and shielded underperforming, low-bid validators, leading to massive inefficiencies and exploitation. The proposed fix is remarkably simple: reverse the order in which priorities are assigned, ensuring that the unstake priority is based on ascending totalPmpe (so lower-contributing validators are unstaked first), and only then re-sort for proper stake assignment. This correction would align the protocol’s actual behavior with its intended incentive structure.

Estimated to be 37,000 SOL in total rewards.

Shiroi published an audit uncovering that, on average, 28% of delegated stake went unpaid each epoch, with some epochs seeing up to 75% unpaid stake. This means many stakers unknowingly received significantly lower rewards than promised, while malicious validators profited from unearned delegations, effectively being subsidized by honest participants. Shiroi emphasizes that this situation not only affects Marinade, but also challenges the credibility of public staking pools across the Solana ecosystem.

To foster accountability, Shiroi has published a list of the Top 10 epochs by losses and Top 10 validators responsible, including identities of several validators still active and receiving delegation — some from the Solana Foundation and Jito. In a particularly alarming revelation, six of the top offending validators continue to benefit from Solana Foundation delegation. Unless the community responds meaningfully, Shiroi warns it will escalate the issue to the Solana Foundation directly. All supporting data, methodology, and proof will be released publicly to support their findings.

One validator named Paws responded by acknowledging Shiroi’s work but disputed the accusation that validators “robbed stakers.” He emphasized that validators are only responsible for maintaining uptime and delivering rewards based on their stated commission rates—not for ensuring Marinade’s staking mechanism functions properly. He argued that any failure to deliver optimal returns is due to flaws in Marinade's system design and is a responsibility of the protocol, not the validators. Paws concluded that labeling validators as exploiters unfairly shifts blame and reflects personal ethical judgment, not objective wrongdoing.

In April, Jan Legner, a developer with Marinade Finance, responded by acknowledging the issue and stating that Marinade is conducting a broader analysis of the entire auction system. While the stake/unstake priority logic may be addressed, he emphasized that other changes take precedence, and the entire priority system may be reworked. Jan also noted that, even if the proposed fix were accepted, it wouldn’t fully resolve the problem, as malicious actors could still manipulate their unstake priority, suggesting the need for a more comprehensive solution.

Repe, representing Marinade Finance, responded by clarifying that the reported 37,000 SOL figure reflects missed rewards, not actual losses or siphoned user funds. Marinade only displays realized APY, based on actual user returns — not theoretical projections from validator bids. He emphasized that no user funds were at risk, and the system worked within expected parameters, though with room for improvement.

Repe acknowledged that some validators lowered their bids after securing stake, which was unintended behavior. Marinade has already implemented a “BidTooLow” penalty to address this, resulting in over 500 SOL being redistributed to stakers. While the issue around unstake priority logic was raised by the community (notably via GitHub), Marinade’s team determined the suggested fix was insufficient and is instead developing a broader update to the priority system.

He stressed that Marinade’s Stake Auction Marketplace (SAM) was always intended to evolve with validator behavior. The protocol responded as intended — by identifying exploitative patterns and correcting them with code.

The additional rewards are lost.

Marinade plans to enhance the system by building a validator reputation system to reward reliable operators, improving the auction mechanism to better benefit honest validators, and further refining priority logic beyond the current fixes.

Repe concluded by reiterating Marinade’s commitment to transparency, continuous improvement, and protecting stakers, asserting that while SAM isn't perfect, it's adapting effectively to ensure fairness and decentralization.

Explore This Case Further On Our Wiki

Marinade Finance, a leading staking platform on Solana, had a critical design flaw in its Stake Auction Marketplace (SAM) caused validator incentives to work in reverse, quietly allowing underperforming validators to retain stake while high-yield ones were penalized. This flaw—rooted in misassigned unstake priorities—led to an estimated 37,000 SOL in missed rewards for mSOL holders across 126 epochs. Community investigator Shiroi exposed the issue, revealing that up to 75% of stake earned no returns during certain epochs, with several top-offending validators still receiving delegation, including from the Solana Foundation. Validators like Paws deflected responsibility to Marinade’s system design. Marinade’s team acknowledged the problem, implemented a partial fix via a bid penalty, and is reportedly working on a full overhaul of the priority logic along with a new validator reputation system, while claiming no actual losses occurred and emphasizing realized returns.

Slow Roasted Stake - Rekt News (May 28)
Rekt HQ - "A sneaky bug in @MarinadeFinance, Solana's liquid staking protocol, flipped the rules upside down - letting low-effort validators with low bids leech millions in rewards." - Twitter/X (May 28)
Marinade Finance Homepage (May 28)
Marinade's $5M Stake Sucker Punch - Rekt Report - Gemini (May 28)
Incident Report: 37,000 SOL in Losses — A Call for Investigation and Action - Marinade Finance Forum (May 28)
unstakePriority Calculation Appears Economically Suboptimal - Marinade Finance Github (May 28)

More case studies

ZKSync Unauthorized Airdrop
Minting Private Key Leakage

KiloEx Public Price Oracle
Access Control Vulnerability