News

369 Guard

Global security awareness — not only PulseChain.

Permalink for this incident. Same content as the News feed — use Share to post it.

All newsAbout

Cross-chain security awareness in plain English. Not an audit. Not financial advice. We never publish drain recipes or exploit steps. News items are research snapshots from public reporting — not always a full 369 deep-dive.

mediumEthereumdefi

Index Coop / Set ExchangeIssuance: ~$9.6k TOCTOU on issuance helper

~30 Jul 2026: SlowMist flagged a ~$9.6k drain on Index Coop / Set Protocol’s public ExchangeIssuance helper. An attacker used a malicious Set and manager hook so component amounts changed between quote and pull, then emptied residual inventory that had sat on the helper. Small dollar size; clean check-then-act pattern. Confirmed firm alert + explorer tx — not a rumor thread.

369 take: Public helpers that leave leftover tokens and trust live state between check and transfer are loaded guns even at tiny TVL. Pulse lesson for any issuance / swap / “issue for exact” router: lock what you quoted, don’t park dust, don’t let hooks rewrite amounts mid-flow.