HypurrFi Pauses Markets Due to Rounding Error Vulnerability

HypurrFi, a decentralized lending protocol operating on the HyperEVM blockchain, has announced the suspension of specific lending markets following the discovery of a critical rounding error vulnerability. The security flaw, which affects versions prior to Aave V3 3.5, was identified through the platform's internal monitoring systems. While the protocol has halted new supply and borrowing activities for affected assets, the team confirmed that user funds remain secure and that withdrawal and repayment functions continue to operate without disruption.

Mechanism of the Rounding Error Exploit

The vulnerability resides in the core logic of earlier Aave V3 iterations, which HypurrFi utilizes as its underlying architecture. Under specific technical conditions, an attacker could theoretically exploit the calculation of interest or collateral units through a repetitive cycle of supply, withdrawal, borrowing, and repayment operations. By executing these cycles at high frequency, malicious actors could gradually extract underlying tokens from the liquidity pools.

According to the developers, the risk is currently isolated to the XAUT0 and UBTC markets within the HypurrFi Pooled system.

XAUT0 and UBTC represent specialized assets within the ecosystem that may be particularly sensitive to small precision discrepancies in the protocol's accounting logic.

Response and Precautionary Measures

Upon detecting the anomaly on-chain, HypurrFi immediately froze the impacted markets to prevent any potential drain of capital. The protocol’s swift response was facilitated by its proactive monitoring infrastructure. Current measures taken by the team include:

• Suspension of new lending and borrowing for XAUT0 and UBTC.
• Maintaining active status for withdrawals and debt repayments to ensure user liquidity.
• Continuous operation of all other collateral markets on the platform.
• Engagement with security researchers and other Aave deployers to finalize a permanent fix.

HypurrFi is currently collaborating with other Aave deployers and security researchers to address the issue, and has invited other Aave fork projects to contact them for more security information.

Impact on the DeFi Ecosystem

The discovery of this rounding error highlights the ongoing challenges of maintaining forked DeFi protocols. As the vulnerability is rooted in an older version of the Aave V3 codebase, the HypurrFi team has extended an invitation to other decentralized finance projects utilizing similar software to share security data. This collaborative approach aims to prevent the exploitation of other protocols that have not yet upgraded to version 3.5 or higher.

In conclusion, HypurrFi’s proactive stance has successfully mitigated the immediate threat of asset loss. By identifying the flaw before it could be weaponized on a larger scale, the protocol has maintained the integrity of its Total Value Locked (TVL). The incident serves as a reminder of the necessity for robust on-chain monitoring and the importance of timely software updates within the evolving EVM ecosystem.