Aave V3.8 security upgrade now live on 15 V3 markets
BlockBeats reports that, following approval by the Aave DAO, Aave V3.8 has been launched on 15 V3 markets, adding reentrancy protection to pool operations.
Loading…
bibibi.ccbibibi.ccLoading…
Connect scattered updates into a story you can understand.
BlockBeats reports that, following approval by the Aave DAO, Aave V3.8 has been launched on 15 V3 markets, adding reentrancy protection to pool operations.
Scroll stated that it has fixed a vulnerability in the mainnet batch version 10 proof verification contract, and said the vulnerability was not exploited on the mainnet.
The Polkadot forum retrospective shows that from October 24 to 26, the XCM executor vulnerability on Asset Hub was exploited, causing a loss of approximately 1381000 USD worth of DOT; the sole liquidity provider of the affected pool was the Polkadot Treasury.
Hifi Finance discloses that Hifi DAO suffered a governance takeover attack and urges users to withdraw collateral immediately. The team said preliminary losses are approximately 20000 USD and that it will compensate affected parties.
zkLink Confirmed ongoing attacks on Arbitrator contracts on Ethereum and Optimism;zkLink Nova block production has been paused and withdrawals closed. The team is repairing the contracts and reviewing related components; the attacker can receive a 20% white-hat bounty for returning the funds.
EthSystems said its privacy pool has completed formal verification from the written specification through Sepolia testnet bytecode, and disclosed that the verification identified 6 issues and the security assumptions that remain in place.
Ethereum Foundation researcher Toni Wahrstätter stated that, after discovering compatibility and security issues between EIP-8037 and some smart contracts, core developers delayed the Hoodi testnet’s Glamsterdam upgrade.
PANews Daily roundup says that the Swell administrator key is suspected to have been leaked, and malicious contract upgrades may threaten approximately 2500 ETH; this claim has yet to be officially confirmed.
UNCX stated that October 14 its Smart Token Vesting V2 was exploited, with 11 excess withdrawals confirmed across chains and verified losses of approximately 807600 USD. White hats have returned some X tokens and ETH。
SlowMist disclosed that UNCX was attacked due to a share-validation flaw in VestingManager.cancel(uint256), with losses of approximately 86000 USD. The attacker exploited the share conversion rate and the mechanism for canceling released plans to claim excess tokens.
Citing Defimon Alerts, BlockBeats reported that an address withdrew funds from a dormant MakerDAO ETH-A liquidation bot proxy: 200 tokens WETH. The incident arose because the third-party proxy's exit function lacked access controls; the MakerDAO core contract operated as designed.
PANews reported that Arbitrum to guard against attacks targeting non-standard Stylus compiler toolchains,WebAssembly new contract activations on One and Nova have been temporarily blocked.Stylus Activated applications and ordinary Solidity contracts are unaffected, and no risk of stolen funds has been identified so far.