Radiant Protocol Flash Loan Attack Review / Binance Launchpool Game Project XAI / Tiny SPL Token Standard

·

Understanding Key Developments in Crypto: Security, Gaming, and Token Innovation

The crypto landscape continues to evolve at a rapid pace, with critical updates in blockchain security, Layer-3 gaming infrastructure, and innovative token standards. This comprehensive overview dives into three pivotal developments: the Radiant Protocol flash loan attack, Binance’s new Launchpool project XAI on Arbitrum, and the emergence of the Tiny SPL token standard designed to reduce storage costs on Solana.

These stories highlight both the vulnerabilities and breakthroughs shaping today’s decentralized ecosystem — from exploited rounding errors in lending protocols to scalable solutions that enhance user experience and lower barriers for broader adoption.

👉 Discover how blockchain security flaws can be exploited — and how you can stay ahead of risks.

Radiant Protocol Flash Loan Attack: Root Cause and Exploitation Flow

In early 2024, Radiant Protocol, a cross-chain lending platform operating on Arbitrum, BNB Chain, and Ethereum, suffered a major exploit resulting in over 1,902 ETH lost (valued at ~$4.5 million). The breach was not due to an external smart contract vulnerability but rather a subtle mathematical flaw amplified by flash loan mechanics.

What Went Wrong?

The core issue stemmed from Radiant’s interaction with the newly deployed native USDC market on Arbitrum. As the first user to interact with this market, the attacker exploited a rounding error in the burn function related to how liquidity indices were calculated and scaled.

This vulnerability allowed the hacker to manipulate token balances by inflating the liquidityIndex — a variable used to track accrued interest and adjust user shares in the pool — using repeated flash loans from Aave.

Step-by-Step Breakdown of the Attack

  1. Initial Flash Loan: The attacker borrowed 3 million USDC via Aave’s flash loan feature.
  2. Deposit & Index Manipulation: They deposited 2 million USDC into Radiant, setting the initial liquidityIndex at 1e27.
  3. Amplification Loop: By taking out a $2M flash loan from Radiant itself and repeating this process 151 times, they inflated the liquidityIndex to an astronomical 2.7e38 — a multiplier of 270 billion times the original.
  4. Exploiting Rounding Errors: With the index distorted, the attacker created a new contract and began depositing and withdrawing funds. Due to floating-point precision limitations, small amounts of scaled tokens (like 1 or 2 wei) could be used to withdraw disproportionately large sums of USDC.
  5. Profit Extraction: Through repeated cycles of minting minimal token shares and burning them to withdraw full-value assets, the hacker drained the new USDC market.
  6. Repayment & Profit: After extracting ~90.6 ETH in profit, they repaid the Aave flash loan (including fees) and retained the gains.

Despite the loss, Radiant’s team responded swiftly by pausing the protocol, which helped preserve $313 million in remaining TVL.

This incident underscores the importance of rigorous testing — especially for new markets — and highlights how seemingly minor numerical inaccuracies can lead to catastrophic financial consequences in DeFi.

Binance Launchpool Features XAI: A Layer-3 Blockchain for Web3 Gaming

Binance recently launched its 43rd Launchpool project: XAI, a specialized Layer-3 blockchain built on Arbitrum Orbit and designed specifically for high-performance Web3 games.

Developed by Offchain Labs, XAI aims to solve one of gaming’s biggest hurdles: high transaction costs and poor user experience on-chain.

Why XAI Stands Out

XAI operates as a Layer-3 chain built atop Arbitrum’s Layer-2 solutions (One, Nova, or Goerli), enabling developers to create games with custom logic while benefiting from Ethereum’s security.

Unlike self-managed chains, XAI receives direct technical support from Offchain Labs, making it a strategic pillar in Arbitrum’s gaming roadmap.

Dual-Token Economy: XAI and esXAI

The network uses two key tokens:

Users can freely convert XAI to esXAI without penalties, but reversing the process follows specific vesting rules.

👉 Explore how next-gen gaming blockchains are reshaping player incentives and developer freedom.

Developer and Player Advantages

XAI is engineered to:

To enhance integration, XAI has partnered with Thirdweb to embed wallet management directly into game backends. It also collaborates with five game studios, including Final Form by Ex Populus — the first title set to launch on the XAI chain.

By focusing on usability and creative freedom, XAI positions itself as a foundational layer for sustainable blockchain gaming ecosystems.

Introducing Tiny SPL: A Cost-Efficient Token Standard on Solana

Solana developers now have access to a novel token standard: Tiny SPL, which leverages state compression technology to eliminate rent fees traditionally required for storing token balances on-chain.

The Problem with Traditional SPL Tokens

Standard SPL tokens require each holder’s balance to be stored in an account on-chain. To prevent spam and bloat, Solana charges a small "rent" fee — approximately 0.002 SOL per account — which becomes costly for projects with large user bases.

How Tiny SPL Solves This

Tiny SPL introduces off-chain balance tracking through compressed Merkle trees, drastically reducing data storage needs. Instead of maintaining individual accounts for every user, balances are batched and verified cryptographically when needed.

While users must interact with the tinys.pl interface to split or merge balances before sending tokens, this trade-off enables near-zero storage costs.

For example:

This innovation opens doors for microtransactions, NFT drops, and token distributions at scale — all without burdening users with upfront rent payments.

Frequently Asked Questions (FAQ)

What caused the Radiant Protocol hack?

The attack exploited a mathematical rounding error in the burn function of Radiant’s new USDC market. By inflating the liquidityIndex via repeated flash loans, the attacker manipulated token scaling logic to withdraw more funds than deposited.

Is XAI a Layer-2 or Layer-3 solution?

XAI is a Layer-3 blockchain built on top of Arbitrum’s Layer-2 networks using the Arbitrum Orbit framework. It inherits security from Ethereum while offering customized execution environments for gaming applications.

How does Tiny SPL eliminate rent fees?

Tiny SPL uses state compression via Merkle trees to store user balances off-chain. Only proofs of ownership are stored on-chain, eliminating the need for dedicated rent-paying accounts for each token holder.

Can I trade esXAI on exchanges?

No. esXAI is non-transferable and cannot be traded. It exists solely as a staked form of XAI used for earning rewards, participating in governance, or unlocking ecosystem perks.

Does Tiny SPL work with all wallets?

Not yet universally. Wallets must integrate support for compressed accounts and balance splitting via tools like tinys.pl. However, compatibility is expected to grow as adoption increases.

Was the Radiant attacker caught?

As of reporting, the hacker’s wallet still holds all stolen ETH. No public identification or recovery has been confirmed, though blockchain analysts are tracking fund movements.

Core Keywords

👉 Stay updated on emerging blockchain threats and innovations shaping tomorrow’s decentralized economy.