The attacker exploited a vulnerability fixed in June but missing from production, targeting Polkadot's newly launched dotUSD stablecoin and exposing weaknesses in its security response.

Polkadot's Treasury lost $1.38 million after an attacker exploited a vulnerability developers had fixed months before its new stablecoin launched.

In a Nov. 2 incident report, Parity Technologies, a blockchain infrastructure firm focused on the Polkadot and Kusama ecosystems, revealed that the security flaw had been identified and corrected in its codebase in June but never reached the affected production systems before the Oct. 24-26 attack.

The disclosure exposes a security breakdown surrounding dotUSD, Polkadot's decentralized stablecoin, which launched in October under the governance of the network's decentralized autonomous organization (DAO).

Unlike stablecoins issued by private companies, dotUSD was designed to operate without a centralized issuer, with DOT holders governing decisions through the network's OpenGov system.

However, the vulnerability predated the stablecoin's introduction. Parity initially classified the bug as medium severity because its assessment did not account for how the flaw could interact with dotUSD, which had not yet launched.

The developer later upgraded the vulnerability to critical after the attack exposed its financial consequences.

The breach also followed a public disclosure on Oct. 20, when the security researcher who originally reported the vulnerability posted a forum comment referencing the code fix.

Parity said the researcher removed the comment after being notified that it violated the company's bug bounty rules. The developer believes the disclosure may have given attackers enough information to identify and exploit the vulnerability.

Source link