Mars Finance reports that THORChain has announced its v3.21 upgrade will patch the FIN contract vulnerability on Rujira and enable the restart of the previously suspended application layer. The network has set its upgrade target at block height 28,366,100, with an estimated time of October 23. After the restart, trading, lending, borrowing, and automated transactions on Rujira will resume. Rujira’s products operate via smart contracts within THORChain, not on a separate blockchain; thus, suspending the application layer halts these contracts without affecting THORChain’s base layer. According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding any corresponding position. With support from node operators, the application layer was suspended, affecting only a single position owned by the Rujira team itself—no user funds were lost. Rujira attributes the vulnerability to a flaw in the position transfer function, not to the underlying liquidity strategy’s trading logic. On September 27, Rujira stated that the fix resides at the base layer and has been scheduled for inclusion in v3.21. Regarding the restart window, Rujira’s October 15 proposal includes a conditional grace period: if any credit account position has a loan-to-value ratio above 100% and is eligible for liquidation when the application layer is ready to resume, node operators will be requested to suspend the credit account contract for an additional 24 hours to allow borrowers time to add collateral. Borrowers can already add collateral by using Rujira Borrow or by directly transferring assets to the credit account address. On October 10, Rujira noted that positions still unsafe after the grace period may be liquidated when liquidators trigger the process.
THORChain to Execute v3.21 Upgrade on October 23 to Fix Rujira Vulnerability
MarsBitShare
Summary
THORChain will execute its v3.21 upgrade on October 23 to address a vulnerability in Rujira’s FIN contract and restore the paused application layer. The upgrade is scheduled for block height 28,366,100, with on-chain trading signals expected to resume after the restart. Transactions, lending, and borrowing will be restored following a September 26 exploit in which an attacker manipulated a liquidity position. Node operators paused the layer, but no user funds were lost. Rujira confirmed the fix is at the base layer and will include a 24-hour grace period for borrowers to adjust their risk-to-reward ratio before liquidations resume.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.