THORChain’s fix for the Rujira exploit is set to clear the way for trading and lending to return after an App Layer halt. The v3.21 upgrade patches the FIN contract vulnerability reported on September 26, with activation targeted at block 28,366,100, expected around October 23, according to THORChain’s release notes.
Key takeaways
- The FIN exploit affected one Rujira-owned position, with no user funds lost.
- The upgrade enables Rujira’s halted services to reopen.
- Rujira proposes a conditional 24-hour collateral window before liquidations restart.
THORChain’s Rujira exploit fix targets position transfers
The vulnerability allowed an attacker to move a custom concentrated liquidity (CCL) position they did not own. Rujira attributed the exploit to the position-transfer function, rather than the strategy’s trading logic.
Rujira reported the incident on September 26 and paused its App Layer with support from node operators. Only one position, held by the Rujira team, was affected; the team said no user funds were lost.
CCL supplies liquidity within a price range chosen by the user, according to Rujira’s documentation. The patch addresses the transfer vulnerability at THORChain’s Base Layer, as Rujira explained in its September 27 update. THORChain’s release notes say v3.21 uses a private binary that includes additional security patches.
Rujira’s restart targets block 28,366,100
The upgrade targets block 28,366,100, projected for October 23. Block height determines activation, so the calendar date is an estimate.
THORChain’s fix for the Rujira exploit enables the App Layer to be unpaused, reopening trading, lending, borrowing and automated trading. Rujira said in its October 15 plan that it would request removal of the pause after a successful upgrade.
Rujira’s products operate through smart contracts inside THORChain, not on a separate blockchain. Pausing the App Layer stops those contracts without stopping the Base Layer, Rujira explains.
Borrowers get a conditional collateral window
Rujira’s October 15 plan proposes a 24-hour grace period if any Credit Account position exceeds 100% loan-to-value and qualifies for liquidation when the App Layer is ready to resume.
Under that condition, Rujira would ask node operators to leave the Credit Account contract paused for another 24 hours. The additional time would let affected borrowers add collateral before liquidations restart.
Borrowers can already deposit collateral through Rujira Borrow or send assets directly to their Credit Account address, the team said. In its October 10 warning, Rujira said liquidators can trigger liquidation of positions that remain unsafe after the grace period.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.