Dodging a Bullet

Vesu, a DeFi lending protocol on Starknet, fixed a critical liquidation vulnerability within days of a whitehat hacker named Alex reporting it through Immunefi's bug bounty program, with no user funds lost. The bug was a rounding issue in Singleton::liquidate_position tied to the receive_as_shares flag, which could have let an attacker mint shares worth more than they deposited when combined with a malicious pool extension and flashloans. According to Vesu's full disclosure report, the team removed that feature, whitelisted pool extension contracts, and completed a migration by May 28 with help from ChainSecurity, Argent, and lending pool curators.