##haedal Prehľady komunity a nálada na trhu

·

--

📢 Thank you for your patience. We have completed the Haedal Vault post-mortem report, covering the affected scope, root cause, loss accounting, and current next steps. The total direct loss is estimated at approximately $915,179 (Haedal will cover the user loss). On June 9, we detected abnormal liquidity decline across several Vault pools. To prevent further abnormal activity, we paused the related contracts while investigating the issue. After a thorough diagnosis, we confirmed that the root cause was a hidden cross-version logic issue related to a Vault upgrade deployed at the end of last year. After the newer Vault package was released, older package entrypoints remained callable instead of being fully deprecated through a forced upgrade. This allowed the attacker to mint more Vault LP shares than expected through an older deposit path, then redeem them against the Vault’s underlying assets. The old package, new package, and upgrade had all gone through audit review, and the issue did not surface when each version was reviewed independently. In hindsight, the update should have been treated as a forced upgrade, as keeping older entrypoints callable allowed the hidden cross-version logic loophole to appear. To clarify, the issue was only limited to Haedal Vault. All other Haedal products, modules, and assets remain fully safe and unaffected. We are now working on a patched version, which will go through re-audit and cross-party review before the upgrade and unpause. We are also coordinating with partners on fund tracking and the investigation against the exploiter. As previously stated, all direct losses regarding this incident will be covered by Haedal, and affected users will be made whole. Please rest assured. A detailed fund recovery plan will be shared later once the short-term barriers are cleared. We sincerely apologize for the inconvenience and concern caused. Thank you again for your continued patience while we complete the next steps carefully. 🫡 @HaedalProtocol #haedal

📢 Thank you for your patience.

We have completed the Haedal Vault post-mortem report, covering the affected scope, root cause, loss accounting, and current next steps. The total direct loss is estimated at approximately $915,179 (Haedal will cover the user loss).

On June 9, we detected abnormal liquidity decline across several Vault pools. To prevent further abnormal activity, we paused the related contracts while investigating the issue.

After a thorough diagnosis, we confirmed that the root cause was a hidden cross-version logic issue related to a Vault upgrade deployed at the end of last year. After the newer Vault package was released, older package entrypoints remained callable instead of being fully deprecated through a forced upgrade. This allowed the attacker to mint more Vault LP shares than expected through an older deposit path, then redeem them against the Vault’s underlying assets.

The old package, new package, and upgrade had all gone through audit review, and the issue did not surface when each version was reviewed independently. In hindsight, the update should have been treated as a forced upgrade, as keeping older entrypoints callable allowed the hidden cross-version logic loophole to appear.

To clarify, the issue was only limited to Haedal Vault. All other Haedal products, modules, and assets remain fully safe and unaffected.

We are now working on a patched version, which will go through re-audit and cross-party review before the upgrade and unpause. We are also coordinating with partners on fund tracking and the investigation against the exploiter.

As previously stated, all direct losses regarding this incident will be covered by Haedal, and affected users will be made whole. Please rest assured. A detailed fund recovery plan will be shared later once the short-term barriers are cleared.

We sincerely apologize for the inconvenience and concern caused. Thank you again for your continued patience while we complete the next steps carefully. 🫡
@Haedal Protocol
#haedal

haedal

Haedal 不只處理 SUI liquid staking

Populárne témy