Skip to content
Fear & Greed29 Fear
Crypto market$2.55T−1.5%24h breadth25 up221 downBitcoin$74,961−1%Ethereum$2,137−4.4%Solana$87−2.7%XRP$1.12−3.5%BNB$686−1.3%Top gainersFB$0.301+8.4%LIT$0.743+5.2%XMR$119+4.8%Top losersKNTQ$0.395−15.8%CYBER$0.271−12.6%RAIN$0.0049−12.4%StocksNVDA$187+2.8%TSLA$358+4.2%AAPL$342−0.5%MSFT$531−1%COIN$135−1.5%
Advertisement
THORChain targets Rujira restart with v3.21 exploit fix around October 23

THORChain targets Rujira restart with v3.21 exploit fix around October 23

The upgrade patches a FIN contract flaw that froze Rujira in late September, as the app layer proposes a 24-hour grace period for underwater borrowers

by Estefano Gomez

2 min read

In Security

Share

Follow on Google

THORChain is preparing to restart Rujira, its app layer for trading, lending and automated strategies, with a v3.21 network upgrade that patches the FIN contract vulnerability that froze the platform in late September, The Defiant reported.

The upgrade is set to activate at block 28,366,100, projected for October 23. Once it goes live, trading, lending, borrowing and automated strategies on Rujira are expected to resume, according to Rujira.

Advertisement

Exploit hit a single team-owned position

The vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a corresponding position. Rujira attributed the flaw to the contract’s position transfer function rather than the trading logic of the underlying liquidity strategy.

Only one position, owned by the Rujira team, was affected, and Rujira said “no user funds were lost.” Node operators suspended the app layer after the discovery, halting Rujira’s smart contracts without affecting THORChain’s base layer. Rujira said on September 27 that the fix would ship at the base layer in v3.21.

Grace period proposed for underwater borrowers

Rujira’s October 15 proposal calls for an additional 24-hour suspension of the credit account contract for positions with a loan-to-value ratio above 100% that would otherwise be eligible for liquidation when services resume. The window is meant to give borrowers time to add collateral through Rujira Borrow or by sending assets directly to their credit account address.

Positions that remain unsafe after the grace period may be liquidated once liquidators trigger the process, Rujira said.

Upgrade also restores SOL and ZEC trading

The same release is designed to restore Solana and Zcash trading on THORChain. SOL trading was disrupted by a new Solana transaction type, while ZEC swaps were halted after an outbound matching bug triggered a vault slash that caused no loss of funds. The upgrade also fixes a state-growth bug that had paused limit swaps.

Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.

Next in Security Qubic halts mainnet after wallet drain empties 1,404 accounts