Polkadot Post-Mortem on XCM Vulnerability Incident: Treasury Losses of Approximately $1.381 Million

According to TechFlow on November 5, a Polkadot forum incident post-mortem stated that from October 24 to October 26, an attacker exploited an XCM executor vulnerability in Asset Hub to reduce the accounting supply of dotUSD without changing account balances, causing a pricing imbalance in the DOT/dotUSD liquidity pool. As the sole liquidity provider for the pool, the Treasury suffered an estimated loss of approximately $1.381 million worth of DOT, while user funds were not affected.

The post-mortem was published on November 2. The vulnerability was reported through the bug bounty program in June and fixed in the codebase, but the fix did not make it into the affected production runtime. After an on-chain upgrade applied the fix on October 26, the team rescued the remaining liquidity in the pool; the October 30 upgrade corrected the accounting supply of dotUSD.

Source: TechFlow