Post-mortem update.
A protocol pause stopped an attempted exploit.
No user funds were lost.
The issue was in hub reward-vault balance accounting.
A third-party delegated stake could inflate a strategy’s reported balance.
That inflated vault NAV, which then flowed into the junior / Alpha rate.
An attacker deployed a contract targeting this.
The attempt failed.
With support from
@HypernativeLabs and
@KodiakFi , the issue was flagged and we paused our contracts in time.
The fix has been fork-verified and deployed.
Reported balance now excludes delegated stake.
Deposits and withdrawals are open again.
The protocol is back to normal operation.