CryptoSlate
Polkadot’s Treasury absorbed approximately $1.381 million in losses after an attacker exploited a vulnerability that developers had fixed in June but never deployed to affected production systems. The Oct. 24-26 attack targeted dotUSD, Polkadot’s newly launched decentralized stablecoin, and continued after an emergency measure interrupted one route into the network.
Why it matters
The vulnerability was initially rated medium because the assessment did not account for how it could interact with dotUSD, which launched in October. After the exploit exposed its financial consequences, Parity Technologies upgraded the issue to critical. The incident shows how new network functionality can change the risk posed by a known bug, and how a code fix offers no protection until it reaches production.
The attacker manipulated Polkadot Asset Hub’s cross-chain messaging system to reduce dotUSD’s recorded supply without removing tokens from user accounts. The mismatch distorted prices in the DOT/dotUSD liquidity pool, allowing trades at artificial rates. The Treasury was the pool’s sole liquidity provider and bore the losses.
Market impact
Parity said users lost no funds and dotUSD remained fully backed by USDT. It could not determine whether the attacker also profited from subsequent arbitrage. Snowfork halted its own consensus relayers after suspicious activity, but an independent relayer resumed the exploit on Oct. 26, about six hours before an OpenGov security upgrade took effect.
Runtime upgrade 2.5.1 closed the vulnerability and recovered the remaining pool liquidity. A second upgrade on Oct. 30 corrected dotUSD’s recorded supply without changing account balances and resolved a separate Snowbridge issue. Parity says it is tightening vulnerability assessments, deployment checks and monitoring for unusual asset issuance.
Frequently asked questions
-
How did the Polkadot exploit cause Treasury losses?
The attacker manipulated cross-chain messaging to reduce dotUSD’s recorded supply without removing tokens from user accounts. The mismatch distorted prices in the DOT/dotUSD pool, and the Treasury absorbed the trading losses as its sole liquidity provider.
-
Why was a vulnerability fixed in June still exploitable?
The code fix was never deployed to the affected production systems. Parity had initially rated the flaw medium because its assessment did not account for how it could interact with dotUSD.
-
Did Polkadot users lose funds or was dotUSD unbacked?
Parity said users lost no funds and dotUSD remained fully backed by USDT. The Treasury absorbed approximately $1.381 million in losses from activity in the affected liquidity pool.
-
Why did halting Snowfork relayers not stop the attack?
The measure halted Snowfork’s own consensus relayers, but Snowbridge allows independent participants to operate relayers. An attacker using an independent relayer resumed the exploit.
-
What did Polkadot’s upgrades change after the attack?
Runtime upgrade 2.5.1 closed the vulnerability and recovered remaining pool liquidity. A later upgrade corrected dotUSD’s recorded supply without changing individual account balances and resolved a separate Snowbridge issue.
TheBlock
WatcherGuru
CoinDesk
WuBlockchain