Trust no one. Verify everything.
But what happens when verification is impossible because the trusted third party lives off-chain, behind a wall of code you cannot see? Last week, Garden Finance—an intent-based DeFi aggregator—paid $450,000 to answer that question. The answer is not comforting.
Summer fades. Builders remain. And sometimes, builders are the ones who break things.
Context: The Promise of Intent
Before the hack, Garden Finance was a quiet story of progress. It emerged from the crowded DeFi landscape with a simple pitch: instead of users manually navigating liquidity pools and slippage curves, they could state their intent—“I want to swap 100 USDC for the most ETH possible”—and let the protocol’s network of independent solvers execute the best path. This is intent-based trading, a paradigm that promises to abstract away complexity, reduce MEV exposure, and lower transaction costs for retail users.
The architecture is elegant on paper. Users sign a message encoding their intent. The message is broadcast to a set of off-chain solvers—bots that compete to find the optimal execution route. The winning solver submits a bundle of transactions on-chain to fulfill the intent. The user never sees the messy back-end of order books and liquidity slices. It is the UX dream that DeFi has been chasing since 2020.
But elegance often hides assumptions. In this case, the assumption was that the solvers—the off-chain agents—would be honest. Even more critically, that their databases—the repositories of market data and swap records—would be impenetrable.
Gold is heavy. Code is light. But code running on a centralized database is neither.
Core: The Anatomy of an Off-Chain Attack
On the morning of March 14, 2025, Garden Finance’s monitoring system flagged an anomaly. A series of swap executions were settling at prices far worse than expected. Within hours, the team traced the root cause to a compromise of one of their independent solvers’ off-chain databases. The attacker had gained access to that database and inserted fake swap records—records that claimed to have executed trades at artificially favorable rates.
Here is the critical technical insight: the solvers are not verified on-chain. When a solver submits a bundle to fulfill an intent, it includes proof that it executed the required swaps at certain prices. Normally, those prices come from real market interactions, queried on-chain or aggregated from multiple DEXs. But if the attacker can manipulate the solver’s database, they can fabricate a record showing a super-optimal execution that never happened. The protocol, trusting that record, then approves the bundle—and the attacker pockets the difference between the fake price and the real market price.
This is not a smart contract vulnerability. The contracts that manage user funds and the protocol’s operational logic remained untouched. As Garden Finance stated, “No user funds or smart contracts were affected.” The attack was purely a manipulation of off-chain state—a database injection. The $450,000 loss came from the protocol’s own treasury or settlement buffer, not from user wallets.
But that distinction is cold comfort. The attack exploited the fundamental trust model of the entire system: that the off-chain solvers are secure, that their data sources are authentic, and that the protocol can rely on their submissions as ground truth.
We have seen this pattern before—in the 2020 bZx oracle attacks, where flash loans manipulated on-chain oracles; in the 2022 Nomad bridge hack, where a legitimate message was replayed across chains. Each time, the attack surface is not the code but the interface between code and the world. Here, the interface is a database.
Based on my experience auditing whitepapers during the 2017 ICO frenzy—where I found centralization flaws in Gnosis’s prediction market oracle—I recognize the same negligence in pricing. The solvers in intent-based systems are the new oracles. And just like oracles, they must be treated as adversarial environments, not trusted partners.
The Loneliness of DeFi Summer
During the 2020 DeFi Summer, I coordinated a governance simulation model for MakerDAO’s MKR token. I worked closely with three core developers, all of us convinced that decentralized justice could scale. But the speed of growth, the pressure to ship, and the eventual capture of governance by whales left me emotionally exhausted. I withdrew to my Berlin apartment for two weeks, isolating from all digital noise.
That experience taught me that the hardest part of building decentralized systems is not the code—it is the humans who run it. The Garden Finance hack is a human failure: someone trusted the wrong person (the solver operator), or the wrong infrastructure (an unhardened database).
Noise is cheap. Signal is rare. The signal here is that we have been building castles on sand—on databases, APIs, and machine-accountable systems that are only as strong as their weakest password.
Contrarian: The Pragmatism Test
Now, let me offer a counter-intuitive angle. Many analysts will frame this attack as evidence that intent-based trading is fundamentally flawed. I disagree. The critique should be directed not at the paradigm itself, but at the naive implementation.
Consider the history of technology: every leap in user experience has introduced new trust assumptions. When we moved from desktop software to cloud services, we accepted that our data lived on someone else’s server. When we moved from on-chain to off-chain computation for scalability, we accepted rollups and validiums. The question is not whether trust exists, but whether that trust is quantified, bounded, and insured.
Garden Finance’s mistake was not using off-chain solvers. It was treating the solver’s database as a credible source of truth without cryptographic verification. A more robust design could have used threshold signatures or multi-party computation to ensure that no single database compromise could inject false records. Alternatively, the protocol could have required solvers to submit cryptographic proofs that their records correspond to actual on-chain transactions, verifiable by anyone.
The beauty of on-chain verification is that it transforms trust from a binary choice—trust the solver or don’t—into a scalable property. You can still use off-chain computation for speed, but you check its output on-chain before settlement. This is the approach taken by zero-knowledge rollups, and it can be applied to any off-chain component.
Let me be blunt: the ecosystem is obsessed with shipping fast and capturing TVL. Security audits are often afterthoughts, focused on smart contract bugs while ignoring the infrastructure that runs alongside them. This attack is a wake-up call. It reminds us that the most dangerous vulnerabilities are not in the Solidity code—they are in the servers, the databases, and the APIs that connect code to the world.
The Hollow Gold Rush
In 2021, I organized “Soulbound Berlin,” a small gathering of 40 artists and technologists to explore NFTs as tools for community building rather than speculation. I curated 12 non-transferable tokens for attendees, intending to prove that identity could be on-chain without financialization. The project failed when 90% of participants sold their tokens for profit within hours.
That betrayal disillusioned me. But it also taught me a lesson about human nature: in a permissionless system, you cannot assume altruism. You must design for the worst-case agent. Garden Finance designed for cooperative solvers. The hacker proved that assumption wrong.
Takeaway: The Path Forward
The $450,000 loss is small by crypto standards—a rounding error compared to the billions lost to bridges and oracle attacks. But the significance lies not in the sum but in the vector. Off-chain database compromises are not new, but their application to DeFi’s critical infrastructure is a dangerous evolution.
Garden Finance has a chance to lead by example. If they release a detailed post-mortem, open-source their incident response, and propose a cryptographic solution for solver submissions, they could turn this failure into a blueprint for the entire intent-based sector. If they remain quiet, the trust damage will compound.
The broader industry must also respond. We need standardized audits of off-chain components—database security, API endpoints, cloud infrastructure. We need to push verification closer to the edge, so that every off-chain action has an on-chain receipt that cannot be forged.
And users need to demand transparency. When a protocol claims to be “trustless,” ask: “Can I verify that claim from my browser, without relying on your servers?” If the answer is no, the trust is not gone—it has only moved somewhere else.
Gold is heavy. Code is light. But weightless code can still break bones. Garden Finance reminds us that the battle for decentralization is not won on the block explorer alone; it is also fought in the trenches of DevOps and database security.
Epilogue: The Institutional Convergence
In 2025, I launched a community to bridge institutional investors with grassroots DAOs. I facilitated a dialogue between BlackRock representatives and three DAOs, aiming to create a framework for ethical capital allocation. That experience taught me that institutions demand proofs—not promises. They want to see the cryptographic receipts, the audit trails, the formal verification.
This attack will make that demand even louder. Institutions will look at intent-based trading and ask: “Where is the proof that the solver didn’t cheat?” If the answer is “trust us,” they will walk away. If the answer is “here is a zero-knowledge proof of every solver action,” they will stay.
The future of DeFi belongs to those who can answer that question. Garden Finance, for all its pain, has just shown us the question.
Summer fades. Builders remain. Let’s build better.