Smart contracts

Balancer

2026-09-15 16:13:58

Balancer weighs an orderly shutdown as governance proposal puts DAO treasury distribution on the table

Balancer is discussing a proposal that could wind down the long-running DeFi liquidity protocol and return remaining DAO treasury assets to BAL holders. The proposal, put forward by Balancer Labs CEO and Treasury Council member Marcus Hardt, is now under forum discussion, with a Snapshot vote expected between Sept. 25 and Sept. 29. Balancer said no shutdown decision has been made at this stage, and that liquidity pools and withdrawals remain fully operational unless governance approves the plan. Hardt said the protocol’s April restructuring — which included cost cuts, ending BAL emissions, simplifying the token model and redirecting protocol revenue to the DAO — failed to restore sustainable revenue growth. According to the proposal, Balancer’s monthly spending is about $150,000, while protocol revenue in August was roughly $30,000, down from about $97,000 in June. Treasury asset management adds about $25,000 a month, and the managed DAO treasury is valued at no less than $9 million at current token prices. If approved, Balancer would move through a phased shutdown beginning in late 2026, eventually leaving only withdrawal infrastructure and documentation. Treasury assets would be distributed over multiple rounds, and BAL holders would need to burn their tokens to claim a proportional share of the treasury’s actual token holdings.

840

CoinDesk

2026-09-15 10:27:55

Security firms say $7.8 million wallet drain came from authorized helper contract, not Safe

Security firms traced a $7.8 million crypto wallet loss to an authorized helper contract rather than to Safe itself, according to CoinDesk. The available details point to a simple coding mistake as the opening that allowed the attacker to drain the funds. That distinction matters because the incident was not attributed to a flaw in Safe, but to a contract the wallet owner had previously approved. CoinDesk’s summary did not provide additional technical details, a timeline of the exploit beyond the report date, or the identity of the wallet owner and attacker.

280

ether.fi

2026-09-11 09:36:54

SlowMist says ether.fi AtomicQueue flaw led to theft of about 15.45 ETH

SlowMist said ether.fi’s AtomicQueue contract was exploited because the solve() function lacked access control, leading to the theft of about 15.45 ETH. According to the security alert, the attacker used updateAtomicRequest() to create a malicious request and forced a victim address to act as the solver. AtomicQueue then called the victim’s finishSolve and executed want.transferFrom, abusing an existing ERC-20 approval to move funds. SlowMist said it had privately disclosed the issue to the ether.fi team before making it public. The attacker address and the vulnerable contract address have also been released. The disclosure outlines a case in which previously granted token approvals were used in an unintended way through contract logic rather than through direct wallet compromise.

780

SlowMist

2026-09-11 09:36:59

SlowMist says ether.fi exploit led to loss of about 15.45 ETH

Blockchain security firm SlowMist said on X that ether.fi was hit by an attack that resulted in a loss of about 15.45 ETH. The firm added that it had contacted the ether.fi team privately for responsible disclosure before making the incident public. According to SlowMist’s analysis, the root cause was an access-control issue in the AtomicQueue contract’s solve() function. The function did not verify whether the supplied solver parameter matched msg.sender, and it also lacked signature, registration, or authorization checks. SlowMist said the attacker first crafted a malicious AtomicRequest through updateAtomicRequest(), then forced a victim address to act as the solver. AtomicQueue then called finishSolve on the victim address and executed want.transferFrom(solver, users[i], assetsToUser), allowing the attacker to drain funds by using ERC-20 token allowances that the victim had previously granted.

740

BlockSec

2026-09-11 05:59:50

BlockSec Phalcon launches blockchain penetration testing service

BlockSec Phalcon has rolled out a blockchain penetration testing service that covers the full path from signing and authorization to fund logic and onchain transactions. According to the announcement cited by Techub News, the service can run adversarial testing within an agreed scope and provide evidence for each confirmed path. BlockSec said conventional cloud and web penetration testing usually stops once funds begin to move, leaving critical transaction-stage risks outside the test process. Its new offering is designed to extend adversarial security validation into signing, authorization, and onchain transaction flows. The service is now live, and users can apply for testing through the company’s official website.

170

Arc

2026-09-10 07:45:03

Arc adds transaction memos on testnet for structured contract-call context

Arc, a blockchain project under Circle, said transaction memos are now available on its testnet. The feature lets developers attach structured context to a single contract call without changing existing contracts. According to Arc’s post on X, the intended uses include invoice numbers, payment reference numbers, customer IDs, and reconciliation tracking. The update focuses on adding contextual data at the transaction level while preserving current contract setups. No other rollout details were disclosed in the post.

710

Etherscan

2026-09-09 13:16:26

Etherscan launches contract review skill for AI agents

Blockchain explorer Etherscan said it has rolled out Contract Review, a new skill in its "Build with AI" product series, aimed at AI agents. The feature lets users submit a verified contract address along with the name of the blockchain it is deployed on, then generates a developer-focused report covering the contract’s structure, permissions, and fund flows. Etherscan said the tool works across more than 60 chains. The company also drew a clear line around what the feature does: it is designed for source code interpretation, not for security auditing. The update was announced by Etherscan in a post on X.

750

ZKsync

2026-09-04 10:28:44

ZKsync Announces EraVM Security Upgrade: Instant Framework, 24-Hour Delay, and New Prover

ZKsync has announced a security upgrade for its EraVM chain, introducing an instant upgrade framework, extending execution delay from 3 to 24 hours, and developing a second prover called EraBender to counter AI-driven attacks. Over the next six months, all Boojum/EraVM chains will phase out old execution environments, with each chain setting its own transition timeline. Users holding funds via EOA need no action; those using smart contracts must follow the transition plans. The ZKsync Atlas chain is not affected.

840