Roman | Validator DevOps

Validator DevOps • Web3 Infrastructure • Security Research & Incident Analysis • Nodes, RPC, Bridges, MEV

[Roman | Validator DevOps @RomanChainOps]

Web3 security and infrastructure.

Crypto hacks, attack vectors and asset protection.
Validator operations, nodes, RPC, bridges and MEV.
Monitoring, dashboards and practical tools for blockchain projects.

[Roman | Validator DevOps @RomanChainOps]

POINT OF FAILURE - MOONWELL / MAMO

A thin MAMO market moved ~8×, then its inflated value backed loans in real assets from @MoonwellDeFi.

Security firms estimate ~$8.7M extracted; final accounting is pending. Collateral power was detached from market depth. #DeFi #Web3Security

[Roman | Validator DevOps @RomanChainOps]

Several undisclosed @Core_LN vulnerabilities are being patched. No public fix, affected-version map or confirmed exploitation is available yet.

CLN operators without the signed build: restart with `--offline`—not a shutdown. The daemon must keep watching Bitcoin. #Bitcoin

[Roman | Validator DevOps @RomanChainOps]

@FortaNetwork traced the path: a DELEGATECALL storage collision gave attacker manager rights. A malicious adapter moved ENJ-backed items without approvals; melt() released backing ENJ.

Migration is not decommissioning: legacy authority must be removed.

#Web3Security #Ethereum

[Roman | Validator DevOps @RomanChainOps]

POINT OF FAILURE - ENJIN LEGACY CRYPTO ITEMS

A pre-2023 Ethereum contract tied to @enjin was drained of ~$162K. Current public accounting puts it at ~6.52M ENJ; no official final total is public yet.

Enjin Chain, native ENJ and the ENJ ERC-20 were not compromised.

[Roman | Validator DevOps @RomanChainOps]

@KiiChainio shows the lesson: shared code turns a local bug into a fleet incident.

A patch is not containment. Chains need an affected-version map, private notice, signed binaries and a rehearsed halt/upgrade path.

The failure domain is the dependency graph.

#Web3Security

[ControlZ @ControlZ_1337]

I read KiiChain’s postmortem and realized something pretty crazy. About 3 weeks ago, we privately reported a critical exploit chain to another Cosmos-based project that reached the same unsafe StateDB subtraction through a completely different path. Thankfully, they confirmed and fixed it really quickly.

These weren’t the exact exploit chain, but they shared the same unsafe StateDB balance primitive: a native balance subtraction that could wrap around in `uint256`. Letting it underflow is an important primitive, but the subtraction alone isn’t enough to steal anything.

Normally, the EVM checks that an account has enough balance before subtracting. To exploit this, you still need another state or accounting bug that breaks that assumption, and then a way to turn the broken balance into real money.

So this does NOT mean every Cosmos EVM chain was exploitable. It depends on the implementation and how each chain keeps its Cosmos and EVM balances in sync.

Sadly, we made a mistake: we didn’t go looking through every other chain that might have had the same primitive.

I tried to understand why, and I think there are 2 main reasons:

1. We focus our research on targets that have bug bounty programs. We didn’t even know some of these other chains existed, and we weren’t aware of a bounty program for projects like KiiChain. Blackhats don’t have that restriction.
2. The underflow primitive on its own isn’t enough to steal funds. An affected project would also need a separate bug that makes the underflow reachable and exploitable. This made us wrongly assume the issue was specific to the project we were reviewing.

I’m genuinely sad that we didn’t connect the dots before real users got hurt.

But on the bright side, our report helped protect literally tens of millions of dollars (no exaggeration) on the chain we reviewed (though we haven't gotten paid for this one yet).

I think this incident shows why bug bounty programs and responsible disclosure matter. It also shows why security updates need to be coordinated between upstream maintainers and the downstream projects using their code.

[Roman | Validator DevOps @RomanChainOps]

Point of failure: lender protection ≠ borrower safety.

Curators: thin PT markets need lower LLTVs, tighter caps and manipulation-aware oracles.
Borrowers: <3% buffer was not risk capacity.

A valid price can still be unsafe collateral input.

#Web3Security #DeFi

[Roman | Validator DevOps @RomanChainOps]

POINT OF FAILURE - Morpho / PT-reUSD

A ~3% move in PT-reUSD triggered ~$36.4M in liquidations on @Morpho. No bad debt was created.

Per @pendle_fi, the market oracle worked as intended: lender protection held, but tightly looped borrowers were exposed to a thin market.

[Roman | Validator DevOps @RomanChainOps]

PT-reUSD positions used a 91.5% LLTV; some had <3% buffer.

A burst of YT-reUSD buys pushed PT down. The 15-min market average became the lower oracle input, cutting collateral values and triggering 33 liquidations.

@doxe_0x: ~$35.19M USDC + $956K USDT debt repaid.

[Roman | Validator DevOps @RomanChainOps]

Takeaway: a timelock the proposal can zero is not a security boundary. In opt-out governance, silence authorizes execution.
Official: https://t.co/ZSL0imbVLh
Tx: https://t.co/n44OpUkKjb
Analysis: https://t.co/dP4dupYhQj
PR: https://t.co/EA1Fiq34mw
#Web3Security #DeFi
9/9

[Term Labs @term_labs]

Update: All Term Meta Vaults were shut down and dao governance roles have been revoked. This shutdown is irreversible and permanently prevents further deposits. Withdrawals remain open.

Today's incident involved Term Vault governance. Based on our investigation so far, the underlying Term protocol and its direct borrowing and lending markets have not been affected. We are continuing to verify scope.

We are coordinating with external security teams on remediation and recovery. If a shortfall remains, we will explore paths to address it.

We will continue to share verified updates here. For your security, rely only on communications from @term_labs and beware of impersonators.

[Roman | Validator DevOps @RomanChainOps]

POINT OF FAILURE - Term Finance
~$8.5M left @term_labs Meta Vaults.
No leaked key, oracle failure or reentrancy. A governance proposal sat in public view for six days, received zero vetoes, disabled its own delay and spent the vault.
This was an authorization failure.
1/9

[Roman | Validator DevOps @RomanChainOps]

Users: rely only on @term_labs updates and verify the exact vault before acting.
For the system:
• independent guardian outside governance
• proposal threshold/bond tied to value at risk
• automated payload simulation + alerts
• cooldown changes behind a separate delay
8/9

[Roman | Validator DevOps @RomanChainOps]

Sources:
Official: https://t.co/quVPkF3c2i
Tx: https://t.co/UblXsFM11R
Code: https://t.co/EWqLx9AVHC
Forensics: https://t.co/Wvk2o06TiB

#Web3Security #BlockchainSecurity
10/10

[717Kinder @717Kinder]

https://t.co/4yhLbmTSfx

[Roman | Validator DevOps @RomanChainOps]

POINT OF FAILURE — TAC

~2.986B TAC left the staking bonded pool.

This was not a conventional mint. Existing native TAC crossed a broken Cosmos–EVM accounting boundary, then moved through the canonical bridge into BNB Chain liquidity.

@TacBuild halted the chain.
1/10

[Roman | Validator DevOps @RomanChainOps]

Main takeaway: cross-VM accounting needs one invariant across every ledger.

Local checks are not enough when bank, staking, EVM and bridge state can disagree.

The smallest missing control was simple: reject any subtraction larger than the available balance - before commit.
9/10