HypurrFi discloses "rounding error" vulnerability in early versions of Aave V3, suspends new lending in XAUT0 and UBTC markets

PANews reported on March 6 that HypurrFi, the native non-custodial lending protocol on HyperEVM, stated on the X platform that versions of Aave V3 prior to 3.5 have a "rounding error" vulnerability. Under certain conditions, attackers could repeatedly perform supply/withdrawal and borrow/repay cycles to extract underlying tokens. The affected markets are XAUT0 and UBTC in HypurrFi Pooled. Currently, user funds are not at risk. To ensure safety, new supply and lending operations in the relevant markets have been suspended, while withdrawal and repayment functions remain available. Other markets are operating normally. HypurrFi added that the issue was quickly detected on-chain through its internal monitoring system and the affected markets were promptly frozen. The team is also collaborating with other Aave deployers and security researchers, and invites other Aave fork projects to get in touch for more security information.