Security firm Innora discovers two critical vulnerabilities in the Ethereum lending protocol Saturn.

ChainCatcher report: Security firm Innora has released a report identifying two critical vulnerabilities in the Ethereum-based yield protocol Saturn, including: Withdrawal Freeze Vulnerability: Under normal operational conditions, all user funds could be locked, with a minimum freeze duration of 30 days—or indefinitely in extreme cases. No hacker intervention is required; the protocol itself can trigger this issue. The privileged address within the protocol is permitted to legally withhold up to 33.33% of funds per transaction. Based on current data, this amounts to a maximum of approximately $157,000 per transaction, with a theoretical total risk exposure of up to $4.26 million. Innora noted that over 90% of Saturn’s assets are managed by the privileged address, leaving users entirely dependent on trust. As of the report’s publication, these vulnerabilities remain unpatched.