FUM

USM

2026-08-10 02:51:48

USM Contract Defund Flaw: 64 Split Redemptions Yield More ETH Than One Large Withdrawal

ChainCatcher reports that the ethFromDefund() pricing logic in the defund() redemption function of the USM contract contains a defect. In calculating a single redemption, the function uses the arithmetic mean of the current FUM sell price and an estimated terminal FUM sell price to determine the payout. This algorithm, however, lacks split invariance. When a redemption is split into smaller transactions, the average-based calculation produces different results. Additionally, each redemption applies a state-shrinkage coefficient known as adjShrinkFactor and an integer rounding mechanism. After combining these factors, a fixed amount of FUM assets split into 64 separate small redemptions ends up yielding a much higher total amount of ether than one large redemption. In other words, the final extractable ETH is not linearly proportional to the redemption size; fragmentation changes the outcome. The report comes from ChainCatcher's market analysis newsflash, without further commentary on potential fixes or a timeline.

1810

USM

2026-08-10 02:51:26

USM Loses ~70.83 ETH as Defund() Pricing Flaw Is Exploited

Odaily reported that USM lost roughly 70.83 ETH in an attack. The incident centers on the contract's defund() redemption function. Within it, ethFromDefund() contains a pricing flaw: each redemption is valued by taking the arithmetic mean of the current FUM sell price and an estimated terminal FUM sell price. The problem is that this calculation is not split-invariant. With the state shrink coefficient adjShrinkFactor and integer rounding applied to each redemption, an identical amount of FUM can be submitted as 64 separate small redemptions instead of one large redemption. As a result, the total amount of ETH that can be extracted is far larger than what a single redemption would yield. The exploit relies on this discrepancy between one large redemption and many small ones, and it stems from the averaging formula rather than from any single anomalous transaction. The report does not specify additional details about the attacker or when exactly the attack took place.

2580

Ethereum

2026-08-10 02:20:37

TenArmor detects attack on Ethereum-based Minimalist USD, with about $160,000 lost

Security monitor TenArmor said it detected an attack involving Minimalist USD on Ethereum, with losses estimated at about $160,000. The assets involved include USM, described in the alert as a stablecoin, and FUM, its companion fund token. The brief notice did not provide added details on how the exploit was carried out, when the attack began, or whether any recovery steps had been taken. The information currently available is limited to TenArmor’s alert and the estimated loss figure it shared.

1840