Security fix disclosure: PropAMM contract We fixed a critical bug in the PropAMM contract in main branch; our factories on Ethereum mainnet are not affected by this vulnerability. The vulnerability found was due to the PropAMM contract that had a leftover setup function, reinitializeV2, which anyone could call once on a newly created PropAMM. Calling it could let an exploiter point the PropAMM at a price feed they control and then trade against its vaults at any price they chose, emptying them. More information here: From our conversations with third parties interested in it and from the information we have seen on-chain, there should not be anyone affected. But if anyone has deployed their own factory, or their own PropAMM forking our code, from this repo's code before October 27, 2026, please follow the instructions below: revoke your vaults' approvals to the PropAMM or move the funds out of the vaults create a new PropAMM through our mainnet factory (address in docs/production.md) or from the latest main. Contact us at security@lambdaclass.com if you need help.