News

Global security awareness — not only PulseChain.

Permalink for this incident. Same content as the News feed — use Share to post it.

Cross-chain security awareness in plain English. Not an audit. Not financial advice. We never publish drain recipes or exploit steps. News items are research snapshots from public reporting — not always a full 369 deep-dive.

mediumEthereumdefi

USM: ~70.8 ETH via redemption pricing that fails when split

10 Aug 2026: SlowMist logged ~70.83 ETH (~$136k class) lost from the USM protocol after a pricing flaw in redemption (`defund` / eth-from-defund style logic). The quote used an average of current and estimated final sell prices for a single redemption but was not split-invariant — combined with per-call state contraction and rounding, many small redemptions paid more ETH than one large redemption of the same size. Firm TI + secondary press; small dollar size, clean math lesson.

369 take: Redemption and mint math must pay the same whether the user splits the call or not. If small chunks beat one big call, attackers will loop it — often with a flash loan. Pulse lesson: stress-test vault / share / redeem paths for split invariance before size.