Polkadot Treasury loses $1.38M in dotUSD smart contract exploit
CIE News ·
Based on reporting by CryptoSlate; not yet independently confirmed.
Polkadot's Treasury lost approximately $1.381 million after an attacker exploited an undeployed bug fix affecting the dotUSD stablecoin, according to Parity Technologies.
Polkadot's Treasury lost an estimated $1.381 million following an exploit targeting the newly launched dotUSD stablecoin between October 24 and October 26, according to a report from Parity Technologies cited by CryptoSlate. Parity stated that developers fixed the underlying cross-chain messaging flaw in June, but the patch was never deployed to production runtimes prior to the attack.
The attacker manipulated Polkadot Asset Hub's messaging system to distort recorded dotUSD supply figures, generating artificial pricing in the DOT/dotUSD liquidity pool. Because the Polkadot Treasury served as the pool's sole liquidity provider, it absorbed the entire financial loss when the attacker traded dotUSD for Polkadot (DOT). An emergency containment attempt failed after the attacker bypassed relayer halts by running an independent consensus relayer before runtime 2.5.1 patched the vulnerability on October 26.
Parity reported that user funds were not lost and dotUSD remained fully backed by Tether (USDT). The firm has launched a review of its vulnerability assessments and emergency response procedures following the incident.
Key facts
- $1.38M Treasury loss
- dotUSD exploit
- Flaw fixed in June
- Patched Oct. 26
Read the original at CryptoSlate