permi

According to the official report from Ostium, the core of this attack lies in the intrusion of the off-chain price reporting system's permissions, unrelated to smart contract vulnerabilities. After gaining off-chain authorization, the attacker submitted forged prices (5,000 USD and 60,000 USD) to the BTC-USD market using the legally registered forwarding paths of the protocol, completing an atomic open-close arbitrage cycle within the same transaction, and starting with a rolling scale of 100 USDC. Through 8 transactions, they extracted 23.75 million USDC from the OLP treasury within 5 minutes, until the treasury's circuit breaker mechanism was triggered.The root cause is the lack of a multi-party approval mechanism at the same level as on-chain multi-signature in the off-chain infrastructure, creating a single point of permission vulnerability. The stolen funds have been converted to ETH and mixed through Tornado Cash, and tracking efforts are still ongoing.

According to official news, Uniswap has launched Permissioned Pools, a new hook standard in Uniswap v4 that supports permissioned asset trading through automated market makers (AMM), with compliance enforced directly on-chain. Permissioned asset pools are collaboratively built by on-chain asset management teams. The first batch of partners includes Superstate, Securitize, and Dowgo.

GoPlus Security issued a security alert stating that a user signed a malicious Permit transaction 183 days ago, resulting in approximately $1,625 of USDC being transferred by a phishing attacker.Since the user did not revoke the relevant authorization afterwards, the attacker again used that authorization to transfer approximately $75,780 of USDC.

According to The Block, Hyperliquid announced that it will introduce a permissionless deployment mechanism for the HIP-4 outcome markets in future upgrades. According to the disclosure plan, validators will vote on outcome templates to ensure market quality and clarity of expression.In addition, HIP-4 market deployers are required to stake 500,000 HYPE and can receive up to 50% of the fee share from the markets they create.

Founder of Strategy Michael Saylor published a post opposing the BIP 110 proposal that restricts the use of inscriptions and other data storage purposes. Bitcoin should adhere to neutrality, open markets, and permissionless innovation, and should not target specific uses through consensus rules.Saylor listed 110 reasons for opposition, emphasizing that Bitcoin should remain conservative at its core. Bitcoin does not need guardians of purity; it needs guardians of neutrality.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

Members of the management team of the Ethereum Foundation (EF) and CSA Operator Aerugo published a systematic explanation of EF's mission. Aerugo stated that EF's core mission is to ensure that Ethereum becomes and continues to be a truly permissionless sovereign infrastructure: censorship-resistant, capture-resistant, open-source, private, and secure, capable of supporting large-scale trustless coordination.He emphasized that EF's focus is on eliminating extraction and capture risks that may arise at the protocol layer of Ethereum, particularly the two core challenges of MEV (Maximum Extractable Value) issues and the lack of default privacy. Aerugo described MEV as "the main battleground of the next cypherpunk war," and pointed out that "a public ledger without serious default privacy is a monitoring infrastructure with settlement guarantees."In addition, EF will move some of its work out of the foundation through spin-offs in the future, but will maintain strict standards for external funding. The recent departure of some personnel is part of normal organizational adjustments, and EF will handle it in a dignified manner without making personnel issues public.

According to Fortune, Mastercard has announced a new protocol called Agent Pay for AI, allowing AI agents to make payments and conduct small transfers among themselves— for example, automatically paying when an AI agent retrieves data from a website in segments. The protocol stores the permissions granted to AI agents by humans on the blockchain, initially using the Polygon network to ensure transparency and verifiability, allowing multiple parties to verify whether the agents are acting as instructed.Companies like Adyen, Coinbase, and Cloudflare are collaborating with Mastercard to develop this protocol. Mastercard's Chief Product Officer Jorn Lambert stated that this protocol will not become a major source of revenue in the short term, but it is expected to develop into a significant new market over the next five years.Giants like Visa, Stripe, Coinbase, and Google are actively laying out AI payment protocols, jointly promoting the future of "machine-to-machine payments" and AI chatbots dominating e-commerce transactions; however, the current volume of agent-based payments remains relatively small.

Aleo released the privacy stablecoin white paper "Stablecoin Privacy," stating that the privacy layer is the key infrastructure missing for blockchain payment rails to be adopted by mainstream institutions. Aleo indicated that as the GENIUS Act provides opportunities for the widespread adoption of stablecoins, the issue of permanently public transaction information on public blockchains may still hinder institutions from using stablecoins in scenarios such as payroll, fund management, and vendor payments.Aleo claims that existing solutions do not adequately meet the needs of institutions in terms of privacy protection and risk management. The white paper proposes a permissionless private stablecoin architecture based on Aleo, which introduces programmable risk mitigation mechanisms while protecting transaction privacy through zero-knowledge technology and programmable smart contracts, allowing institutions to conduct private transactions without sacrificing compliance and risk control.It is reported that the team members behind this white paper have long been dedicated to research at the intersection of cryptography, policy, and financial systems. Aleo's Global Policy Director Yaya J. Fanusie, member of the Crypto Innovation Council and former Global Financial Crimes Compliance Officer at Coinbase Valerie-Leila Jaber, and cryptographer and Johns Hopkins University Computer Science Professor Matthew Green possess rare practical experience in private payments, financial regulation, and zero-knowledge cryptography.

According to GoPlus warning, a user lost approximately $316,000 worth of USDC to a phishing attack due to signing a malicious Permit2 transaction.

Anatoly Yakovenko (toly), co-founder of Solana Labs, responded to discussions about the decentralization level of Hyperliquid, stating that he has raised the same criticism for all L2s: the key to determining whether a system is permissionless lies in whether users can participate in any part of the protocol stack using their own resources without approval from a trusted third party.If they cannot, it is not permissionless. Toly stated that no matter what users do, they cannot run the Base sequencer or the Hyperliquid sequencer, so this is the same issue he criticized with L2s.

According to CCTV News, the chairman of the Iranian Parliament's Civil Affairs Committee stated that under the Parliament's plan for managing the Strait of Hormuz, all traffic in the Strait of Hormuz must obtain permission from Iran, and any goods belonging to Israel are not allowed to pass under any circumstances. Hostile countries engaged in conflict with Iran are not permitted to pass through the Strait of Hormuz until compensation for damages is made.

The Layer 1 blockchain Tempo, developed jointly by Stripe and Paradigm, has launched a privacy feature called Zones. This is a solution for running permissioned parallel blockchains, specifically designed for enterprise-level use cases that require higher confidentiality, such as payroll, fund management, and payment settlement.It is reported that Zones, as a parallel blockchain connected to the Tempo mainnet, provides a private execution environment where internal transactions remain confidential, but assets and funds are fully interoperable with Tempo L1, other Zones, deposit channels, and liquidity pools. Each Zone is managed by trusted entities such as financial institutions or infrastructure providers, allowing operators to view all activities within their environment and implement access controls, but they do not control the underlying assets.

The UK's Financial Conduct Authority (FCA) has released the final draft of the crypto asset framework. This new regulation is set to bring most crypto activities under the regulation of the Financial Services and Markets Act by October 25, 2027.According to the proposal, any institution that holds customer crypto assets for more than 24 hours or has the ability to revoke customer permissions will be considered a regulated custodian and must hold a full safeguarding license. Validators and node operators that provide value-added features such as yield or reward reinvestment will lose their technical exemptions. In addition, stablecoin issuers within the UK must control the entire lifecycle from issuance to redemption. Relevant institutions must submit authorization applications between September 30, 2026, and February 28, 2027.

According to disclosures from the GoPlus Chinese community, a user lost approximately $316,000 in USDC from their wallet due to signing a malicious Permit2 transaction, which was exploited by a phishing attacker.GoPlus advises users to adhere to the "four no" principles for phishing prevention: do not click on unfamiliar links, do not install unknown software, do not sign transactions with unclear content, and do not transfer funds to unverified addresses. They also recommend installing the GoPlus security plugin to intercept phishing risks in real-time.

Monad co-founder Keone Hon released a protocol security self-inspection checklist on the X platform, focusing on core issues such as management permissions, fund security, and multi-signature mechanism design, which mainly includes ten points:Clearly identify which admin functions may lead to fund loss;Ensure that relevant operations are time-locked;Establish a real-time monitoring mechanism;Provide timely alerts when admin functions are called;Review all privileged accounts and try to use a multi-signature (k-of-n) structure;Clarify signature threshold parameters;Multi-signature signers should use independent cold devices solely for signing operations and follow best practices (such as independently verifying transaction hashes);Set rate limits on withdrawals and avoid control by the same multi-signature;Ensure employee devices have malware detection and management capabilities;Predefine extreme scenarios where multi-signature signers are compromised, reverse engineer potential attack paths from the attacker's perspective, and optimize system design accordingly to increase attack costs and complexity.

According to market news, Saudi Arabia announced a 30-day permit exemption for vessels in the Persian Gulf.

According to GoPlus security monitoring, an address starting with 0x9709 signed malicious Permit and Approve transactions, resulting in approximately $200,000 worth of USDC and wmtUSDT being stolen by phishing attackers.GoPlus states that users should carefully verify transaction details and contract addresses when signing any on-chain authorizations (Approve) or offline signatures (Permit) to avoid signing unknown malicious requests and prevent asset theft.

According to GoPlus monitoring, about 8 hours ago, a user lost $1.76 million in USDC to a phishing attack after signing a malicious Permit transaction.

Curve Finance posted on platform X that PancakeSwap seems to have used Curve's code without permission, violating its open-source license agreement. Curve Finance stated that such actions are not only illegal but have historically proven to be unwise in other respects.Curve Finance also pointed out that if PancakeSwap wishes to legally use its Stableswap feature and draw on its security practices to ensure user fund safety, they can still reach out through licensing or collaboration.