🚨SlowMist TI Alert🚨 💸 @Lumi_Finance Loss: ~ $264k 🔍 Root Cause: A vulnerability in Lumi smart accounts allowed token approvals to be performed as a side effect during UserOperation validation. Due to improper validation logic, an attacker-controlled paymaster could trigger approval operations during the validation phase and obtain ERC20 allowances from multiple smart accounts without explicit user intent. 📌 Attacker: 0xce1a3bb0b98d0d90c7dd0620ab86c9a771888d88 📌 Victim: Multiple Lumi smart accounts affected by unintended token approvals during UserOp validation 📌 Malicious contract: 0x56362412ae17cac443aafbab4289946ad958e8a1 The attacker abused a flaw in Lumi smart account UserOperation validation logic to obtain token allowances from multiple wallets through validation-time side effects. The attacker then used the malicious sweeping contract to batch drain approved ERC20 tokens, swapped the stolen assets into ETH, and transferred the proceeds to the attacker-controlled address. Powered by #SlowMist#.AI Tx:

San Francisco startup @lightberry has unveiled Lumi: a $40k social humanoid packing an 8-mic Brooklyn-built array, stereo vision, and NVIDIA Jetson Thor compute onto an upgraded Unitree chassis. We chatted with CEO @aliattar to unpack the split-brain architecture, $20k/year software economics, and navigating sweeping US import bans:

Memory ain’t cheap; No time for distractions. < BWS by Lumina > Stream her music debut here: Artist: @user_lumi. Production: @notjeyzzl. Visuals: @Pankopunk, @arcane_vault, @k9neki, @notjeyzzl, @fangiskhan, @user_hyp3, @divinekonnect

The Onchain Security Roundup tracked 6 major incidents last week, with over $28.3M in reported losses As smart contract security improves, attackers are going after the underlying economic assumptions (oracles, liquidity depth, mark prices) rather than the contracts themselves Ostium: 23.75M USDC drained from its LP vault after offchain price-feed infrastructure was compromised. @blockaid_ reported that a registered PriceUpKeep forwarder and future-dated authorized oracle reports were used to create artificial trading profits to extract funds from the OLP vault. Trading remains paused, with investigation and LP recovery details pending Allbridge Core: $1.65M lost from a flash-loan-assisted manipulation of Allbridge's StableSwap-style automated market maker, where the attacker exploited the same-asset swap accounting divergence. The protocol paused and asked LPs in affected pools to withdraw while the investigation continues Cascade CLS Vault: $1.3M lost after thin-liquidity markets and manipulated mark prices triggered liquidations against the CLS vault. Trading and withdrawals remain paused BarnBridge SMART Yield cUSDC: $776K drained from a dormant protocol after a governance takeover allowed the attacker to use legacy USDC approvals DeFiTuna: $570K lost from a Solana lending-pool issue involving a highly illiquid TUNA/USDC pool, Jupiter routing, and a rounding/solvency-check flaw. DeFiTuna said the vector was identified and mitigated, with investigation and recovery ongoing Lumi Finance / Sodium Smart Accounts: approximately $270K drained after a design flaw in smart-account validation logic allowed an attacker to gain unintended token approvals These are the exact sorts of risk that Nexus Mutual can cover: oracle failures, oracle manipulation, governance takeovers, and smart contract exploits Whether you’re a protocol, investor, or fund looking for protection against the changing risks in DeFi, Nexus Mutual is there to help