以太坊基金会呼吁排查 Glamsterdam 升级的八项不变量
PANews报道称，以太坊基金会提醒开发者和审计方排查合约对八项将受 Glamsterdam 升级影响的不变量的依赖。
Loading…
bibibi.ccbibibi.ccLoading…
Connect scattered updates into a story you can understand.
PANews报道称，以太坊基金会提醒开发者和审计方排查合约对八项将受 Glamsterdam 升级影响的不变量的依赖。
PANews称，CertiK Alert披露TENDRIL卖出钩子漏洞，攻击者几乎提走交易对全部USDT，造成约55.5万美元净损失。
Polkadot论坛复盘显示，10月24日至26日Asset Hub的XCM执行器漏洞被利用，造成约138.1万美元DOT价值损失；受损池的唯一流动性提供者为Polkadot Treasury。
Hifi Finance discloses that Hifi DAO suffered a governance takeover attack and urges users to withdraw collateral immediately. The team said preliminary losses are approximately 20000 USD and that it will compensate affected parties.
zkLink Confirmed ongoing attacks on Arbitrator contracts on Ethereum and Optimism;zkLink Nova block production has been paused and withdrawals closed. The team is repairing the contracts and reviewing related components; the attacker can receive a 20% white-hat bounty for returning the funds.
EthSystems said its privacy pool has completed formal verification from the written specification through Sepolia testnet bytecode, and disclosed that the verification identified 6 issues and the security assumptions that remain in place.
Ethereum Foundation researcher Toni Wahrstätter stated that, after discovering compatibility and security issues between EIP-8037 and some smart contracts, core developers delayed the Hoodi testnet’s Glamsterdam upgrade.
PANews Daily roundup says that the Swell administrator key is suspected to have been leaked, and malicious contract upgrades may threaten approximately 2500 ETH; this claim has yet to be officially confirmed.
UNCX stated that October 14 its Smart Token Vesting V2 was exploited, with 11 excess withdrawals confirmed across chains and verified losses of approximately 807600 USD. White hats have returned some X tokens and ETH。
SlowMist disclosed that UNCX was attacked due to a share-validation flaw in VestingManager.cancel(uint256), with losses of approximately 86000 USD. The attacker exploited the share conversion rate and the mechanism for canceling released plans to claim excess tokens.
Citing Defimon Alerts, BlockBeats reported that an address withdrew funds from a dormant MakerDAO ETH-A liquidation bot proxy: 200 tokens WETH. The incident arose because the third-party proxy's exit function lacked access controls; the MakerDAO core contract operated as designed.
PANews reported that Arbitrum to guard against attacks targeting non-standard Stylus compiler toolchains,WebAssembly new contract activations on One and Nova have been temporarily blocked.Stylus Activated applications and ordinary Solidity contracts are unaffected, and no risk of stolen funds has been identified so far.