Meteora, a liquidity protocol on Solana, said it has completed changes to the accounting design used in its legacy DAMM v1 pools after a flaw allowed LP share calculations to be distorted by external token burns. According to product engineer dann, the revised model has the pool track total LP supply on its own, which means outside burns will no longer affect share accounting. Withdrawals now also require a signature from the LP owner.
Under the previous design, if LP tokens were moved to the System Program or Incinerator address and then burned, the reported total supply would shrink, which in turn inflated the proportional share of the remaining LP tokens. A security researcher found that a third-party wallet used this mechanism across seven low-liquidity legacy pools, increasing its own share to about $12,600. Meteora said it paused and fixed the issue immediately after being notified. The protocol added that, aside from those seven pools, DAMM v1 has now resumed normal operations.
Meteora has changed the accounting design for its legacy DAMM v1 pools after a flaw allowed LP shares to be inflated through external token burns, according to a post from product engineer dann.
Under the updated design, each pool tracks total LP supply internally, so outside burns no longer affect share calculations. Withdrawals now require a signature from the LP owner as well.
In the earlier design, LP tokens sent to the System Program or Incinerator address and burned would reduce total supply, which increased the proportional share of the remaining LP tokens.
A security researcher found that a third-party wallet used that design in seven low-liquidity legacy pools and raised its own share to about $12,600.
Meteora said it paused the affected pools and applied a fix immediately after receiving the report. Aside from those seven pools, DAMM v1 has now returned to normal operation.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
