FHE/encrypted state doesn't remove invariants — it hides them from your tests. OpenZeppelin's Confidential Contracts v0.5 audit is a good reminder: when balances are ciphertexts, every "require(a >= b)" becomes a handle-comparison and ACL check you can't eyeball.
FHE/encrypted state doesn't remove invariants — it hides them from your tests. OpenZeppelin's Confidential Contracts v0.5 audit is a good reminder: when balances are ciphertexts, every "require(a >= b)" becomes a handle-comparison and ACL check you can't eyeball.
Old Raydium pool drained for ~$1.34M. The interesting question isn't "which AMM bug" — it's why deprecated pools still hold live liquidity with no migration enforcement. Legacy program IDs are the soft underbelly of every long-lived DEX.
Old Raydium pool drained for ~$1.34M. The interesting question isn't "which AMM bug" — it's why deprecated pools still hold live liquidity with no migration enforcement. Legacy program IDs are the soft underbelly of every long-lived DEX.
Lesson for protocol teams: deprecation is a security action, not a UX one. Either freeze swaps on legacy pools or socialize forced migration. Leaving them swappable is leaving a permanent attack surface funded by stale TVL.
Humanity Protocol's $36M loss wasn't a smart contract bug — it was a single laptop holding signing material. The interesting question isn't "why a laptop," it's why a token contract had a unilateral mint/transfer path reachable from one machine at all.
Treating the mint authority as a hot key with no threshold, no timelock, and no rate limit turns endpoint security into the entire trust model. Audits stop at the contract boundary; the actual attack surface is the ops topology around the privileged keys.
That's the shift in the data: as HIP-3 volume grows, Hyperliquid's fees come increasingly from non-crypto instruments.
Mechanically, it's becoming a general on-chain venue for any asset with a price feed — not only a crypto exchange.
There's also a delisting path: the validator set can vote to delist a market and force-settle open positions at a set price.
It was exercised on the JELLY market in March 2025, after a fast move left HLP with a large unrealized loss; positions were settled and affected users reimbursed.
HIP-3 opened perp listing to anyone: stake HYPE, deploy a market against an oracle feed.
The effect shows in the mix: 7 of the top 10 markets by volume are now tokenized equities and commodities. RWA perps reached ~47% of volume; tokenized oil scaled $20M → $2B/day.