This is a segment from the Lightspeed newsletter. To read full editions, subscribe. In yesterday’s Alpha Dispatch, I lauded Marinade Finance’s impressive week, which included the beta launch of Instant Unstake and some promising governance improvements. I may have spoken prematurely. Less than 24 hours later, the Shiroi project published an incident report alleging that malicious validators have been exploiting Marinade’s Stake Auction Marketplace (SAM) for over a year. According to Shiroi’s independent audit, at least 37,000 SOL in rewards — worth more than $6.5 million at the time of publication — were siphoned away from the protocol over 126 epochs, allegedly leaving stakers short-changed. Marinade’s auction-based delegation system is at the core of the issue. The way it’s supposed to work is that validators bid for stake, and the protocol distributes delegation accordingly. However, according to Shiroi, the system has allowed select validators to receive stake without paying for it; supposedly as much as 75% of the delegated amount in a single epoch. Across the data set, Shiroi alleges that the unpaid share averaged 28%, potentially nullifying a significant portion of Marinade’s advertised APY for stakers. The report names names, publishing a list of the Top 10 most exploitative validators, many of which are still active on Marinade, and some of whom appear to be backed by Jito or the Solana Foundation. The team says it also identified 24 epochs where over 50% of the delegated stake went unpaid. Shiroi claims that multiple attempts to contact Marinade’s core team went unanswered. To be fair, Marinade had publicly addressed related concerns (as it often does) just a few days before Shiroi’s report, though its focus was specifically on sandwich attacks — another exploitative behavior tied to the auction system.