Hacking Vidhya

{ "code": "E3", "text": "PAUSER_ROLE on OUSG_InstantManager calls pauseRedeem() with no on-chain time cap; only DEFAULT_ADMIN_ROLE can unpause via unpauseRedeem(). PAUSER_ROLE on the OUSG token (0x1B19…ee92) can pause() the token itself, blocking all transfers and effectively freezing redemption claims. State at block 25138750: redeemPaused=false; state at block 25045915: token paused=false." }, { "code": "E4", "text": "There is no separate fast-acting emergency-pause with a time cap distinct from the indefinite governance pause. The same PAUSER_ROLE can pause and stay paused until DEFAULT_ADMIN_ROLE chooses to unpause." }, { "code": "E5", "text": "Redemption queue mechanics: instant redemptions happen at call time, but if the OndoTokenRouter does not hold sufficient USDC/PYUSD at withdrawal time (since the underlying assets are off-chain at Coinbase Prime), the call reverts via OndoTokenRouter.withdrawToken. Minimum redemption is $4,999.99 USD (minimumRedemptionUSD=4999990000000000000000 / 1e18). An on-chain rate limiter (ondoRateLimiter at 0x98Db…003c) caps per-user and global redemption USD value per window — discovered as a sibling contract on the InstantManager surfacer but its limit values were not re-read this run." }, { "code": "E6", "text": "No permissionless escape-hatch / forced-exit / on-chain redemption guarantee in the deployed code. There is no function callable by an arbitrary user (or by the holder unconditionally) that bypasses the pause guard, the KYC check, or the rate limiter to claim against off-chain collateral. USDY additionally enforces an isBlocked check via the Blocklist (0xd8c81…B0a8) on every transfer; the Blocklist is owned by a 1-of-2 Safe (see control slice)." }, { "code": "E7", "text": "Exit functions are directly callable on-chain via Etherscan write tab or any wallet — the redeem method is permissionless from a frontend perspective (no Ondo-domain frontend required). Etherscan history at the InstantManager shows repeated direct Redeem and Subscribe calls from many different EOAs, confirming users can interact without the official app. However, the on-chain ACL gates above (E2, E3) still apply." } ], "steelman": { "red": "Three independent on-chain levers permanently lock a user's exit: (a) PAUSER_ROLE pauses redeem with no time cap; (b) DEFAULT_ADMIN_ROLE on the InstantManager can swap the OndoCompliance / OndoIDRegistry contracts; (c) the USDY Blocklist owner (a 1-of-2 Safe) can add the holder. Ondo's own 2024-03 Code4rena scope acknowledged 'If someone gets sanctioned … or removed from Ondo Finance's KYC Registry their funds are locked.'", "orange": "The minimumRedemptionUSD ($4,999.99) and rate limiter are bounded, redeem is currently unpaused, and direct on-chain redemption succeeds (transaction history shows recent direct-from-EOA Redeem calls within the last day) — for a compliant KYC'd holder the exit is open in the steady state.", "green": "There is no plausible green: the design intentionally couples exit to off-chain KYC continuity, and the rubric treats indefinite pause without time cap as a red trigger when PAUSER_ROLE is not held by a Security Council." }, "verdict": "Choosing red because the rubric's red criteria 'ANY actor (including governance) can pause CLAIMS of finalized exits indefinitely' and 'exit requires admin signature' are both satisfied directly: PAUSER_ROLE can pauseRedeem() with no time cap, and _processRedemption reverts when ondoCompliance.checkIsCompliant or ondoIDRegistry.getRegisteredID fails — both of which are admin-controlled and observed being written by an operator EOA (0x059bC3Db…ba1eB61a9) hourly. The protocol's own acknowledged behaviour is that a de-listed user's balance is locked, which is materially custodial." }, "evidence": [ { "url": "https://etherscan.io/address/0x93358db73b6cd4b98d89c8f5f230e81a95c2643a", "shows": "Verified source for OUSG_InstantManager: BaseRWAManager._processRedemption guards with whenRedeemNotPaused, calls ondoCompliance.checkIsCompliant(rwaToken, _msgSender()) (reverts on non-compliance), checks ondoIDRegistry.getRegisteredID(rwaToken, _msgSender()) != bytes32(0) (reverts on UserNotRegistered), and minimumRedemptionUSD enforcement. pauseRedeem is onlyRole(PAUSER_ROLE) with no timestamp / expiry; unpauseRedeem is onlyRole(DEFAULT_ADMIN_ROLE). retrieveTokens(address,address,uint256) is onlyRole(DEFAULT_ADMIN_ROLE) and can sweep any ERC-20 the contract is holding.", "chain": "Ethereum", "address": "0x93358db73B6cd4b98D89c8F5f230E81a95c2643a", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://defipunkd.com/address/1/0x93358db73B6cd4b98D89c8F5f230E81a95c2643a", "shows": "Live read at block 25138750: redeemPaused=false, subscribePaused=false; minimumRedemptionUSD = 4999990000000000000000 (= $4,999.99 in 18-decimal USD); minimumDepositUSD = 5000000000000000000000 (= $5,000); the InstantManager exposes pauseRedeem / unpauseRedeem in its write surface (role-gated).", "chain": "Ethereum", "address": "0x93358db73B6cd4b98D89c8F5f230E81a95c2643a", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://defipunkd.com/address/1/0x1B19C19393e2d034D8Ff31ff34c81252FcBbee92", "shows": "OUSG token's write surface includes pause() and unpause() (PAUSER_ROLE), confirmed in merged ABI; paused()=false at block 25045915 — i.e., the token is currently unfrozen but the pause primitive that would block ALL transfers (including any 'finalized claim' transfer) is live and unbounded.", "chain": "Ethereum", "address": "0x1B19C19393e2d034D8Ff31ff34c81252FcBbee92", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://etherscan.io/address/0xcf6958D69d535FD03BD6Df3F4fe6CDcd127D97df", "shows": "OndoIDRegistry transaction tab: an operator EOA (0x059bC3Dbe522Da79B346643D420e927ba1eB61a9) repeatedly calls Set User ID against this contract — 521 historical txs, with 20+ in the last 36 hours of the fetch. This is the live on-chain mechanism through which Ondo registers and de-registers users for OUSG access; deregistration → getRegisteredID returns bytes32(0) → redeem reverts UserNotRegistered.", "chain": "Ethereum", "address": "0xcf6958D69d535FD03BD6Df3F4fe6CDcd127D97df", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://defipunkd.com/address/1/0xd8c8174691d936E2C80114EC449037b13421B0a8", "shows": "USDY Blocklist (Ondo Finance Blocklist Oracle): a single owner can addToBlocklist a USDY holder; USDY's transfer hook is documented (per the linked 2023-09 Code4rena scope) to call isBlocked(address) on this contract for every transfer, so a blocklisted user cannot transfer USDY out, which functionally is an exit denial." } ], "unknowns": [ "E5: The OndoRateLimiter (0x98Db…003c) cap values (per-user, global, window) were not re-read on-chain this run; the redeem path's worst-case throughput under normal conditions is therefore not pinned to a number.", "E2: USDY_InstantManager (0xa4261…1f15) source / live state was not separately read; behaviour is inferred to be the same xManager pattern as the OUSG_InstantManager but its accepted-tokens / pause state / KYC registry are not confirmed for this slice." ], "protocol_metadata": { "upgradeability": "upgradeable" } }, { "schema_version": 4, "slug": "ondo-yield-assets", "slice": "autonomy", "snapshot_generated_at": "2026-05-11T09:35:21.490Z", "prompt_version": 29, "analysis_date": "2026-05-18", "model": "claude-opus-4-7", "chat_url": null, "grade": "red", "headline": "Principal sits with off-chain Coinbase Prime custodian and the OndoOracle price is admin-settable with no on-chain fallback — ~100% TVS at risk under those dependencies", "short_headline": "Off-chain custody is the protocol", "rationale": { "findings": [

{ "url": "https://defipunkd.com/address/1/0x1B19C19393e2d034D8Ff31ff34c81252FcBbee92", "shows": "OUSG token is a TokenProxy (TransparentUpgradeableProxy) at block 25045915 → implementation 0x1CEB44b6E515aBf009E0CCb6ddaFD723886cf3Ff; merged ABI exposes proxy admin functions changeAdmin/upgradeTo/upgradeToAndCall (callable only by the EIP-1967 admin slot) and role-gated functions mint, burn, pause, unpause, setKYCRegistry, setKYCRequirementGroup; MINTER_ROLE, BURNER_ROLE, PAUSER_ROLE, KYC_CONFIGURER_ROLE, DEFAULT_ADMIN_ROLE all defined; paused()=false, kycRegistry=0x56A5D911052323D688C731d516530878557463e7, kycRequirementGroup=1.", "chain": "Ethereum", "address": "0x1B19C19393e2d034D8Ff31ff34c81252FcBbee92", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://defipunkd.com/address/1/0xd8c8174691d936E2C80114EC449037b13421B0a8", "shows": "USDY Blocklist (Ondo Finance Blocklist Oracle) is Ownable2Step; owner()=0x99ca4f54F6Bb1c36C662e7C404f517D150FD1173 at block 25138757; write functions addToBlocklist(address[]) and removeFromBlocklist(address[]) are owner-only with no time cap.", "chain": "Ethereum", "address": "0xd8c8174691d936E2C80114EC449037b13421B0a8", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://defipunkd.com/address/1/0x99ca4f54F6Bb1c36C662e7C404f517D150FD1173", "shows": "Gnosis Safe v1.4.1 at block 25138758: getThreshold()=1, getOwners()=[0xae8224d6439b7bdcC97B97190183ACD23C895416, 0x72BB40789689fD27C9eDc6B2BA6FFcdB2a509aFD], nonce=7. A single owner's signature is sufficient to execute any transaction including addToBlocklist on the USDY Blocklist it owns.", "chain": "Ethereum", "address": "0x99ca4f54F6Bb1c36C662e7C404f517D150FD1173", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://defipunkd.com/address/1/0x9Cad45a8BF0Ed41Ff33074449B357C7a1fAb4094", "shows": "OndoOracle merged ABI at block 25138753: DEFAULT_ADMIN_ROLE, AGGREGATOR_V3_ORACLE_SETTER_ROLE, HARDCODED_SETTER_ROLE, RWA_ORACLE_SETTER_ROLE; write surface setHardcodedPrice(token,price), setTokenToAggregatorV3Oracle(token,oracle,delay), setTokenToOracleType(token,uint8), setTokenToRWAOracle(token,rwaOracle) — i.e., admin roles can replace the price source for any token with no on-chain timelock or bounding check.", "chain": "Ethereum", "address": "0x9Cad45a8BF0Ed41Ff33074449B357C7a1fAb4094", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://docs.ondo.finance/trust-and-security", "shows": "Ondo's published governance: Ondo I LP (OUSG) is managed by Ondo I GP LLC; Ondo Capital Management LLC is the Investment Manager; USDY is issued by Ondo USDY LLC, a FinCEN-registered MSB. No mention of an on-chain Governor, timelock, or token-vote in the administration of OUSG or USDY contracts." } ], "unknowns": [ "C1: getRoleMember / getRoleMemberCount calls against the AccessControlEnumerable contracts returned HTTP 400 from the defipunkd /api/contract/read endpoint when bytes32 args were passed, so the concrete addresses holding DEFAULT_ADMIN_ROLE, PAUSER_ROLE, CONFIGURER_ROLE, ADMIN_SUBSCRIPTION_ROLE, MINTER_ROLE, BURNER_ROLE, KYC_CONFIGURER_ROLE, HARDCODED_SETTER_ROLE on OUSG_InstantManager / OUSG token / OndoOracle were not re-read on-chain this run. The role definitions and modifier gates are confirmed; the holder identities (single EOA vs multisig vs role-admin chain) are not.", "C2: The EIP-1967 admin slot for the OUSG token (0x1B19…ee92), USDY token (0x96F6…985C) and OndoIDRegistry (0xcf69…D97df) proxies reverts on the public admin() getter because it is gated by the TransparentUpgradeableProxy ifAdmin modifier; the concrete proxy admin address was not pulled via eth_getStorageAt(slot=0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103) this run.", "C4: The two USDY-Blocklist Safe owners 0xae82…5416 and 0x72BB…9aFD are EOAs whose real-world identity (Ondo team member vs independent signer) was not verified.", "C7: Polygon CashManager (0x6B7…ee945) and Polygon OUSG Registry (0x7cD…59AC1) were not separately read this run; the control surface on the Polygon deployment is assumed similar but not confirmed." ], "protocol_metadata": { "github": ["https://github.com/ondoprotocol", "https://github.com/ondoprotocol/usdy", "https://github.com/ondoprotocol/tokenized-funds"], "docs_url": "https://docs.ondo.finance", "audits": [ { "firm": "Spearbit", "url": "https://github.com/spearbit/portfolio/blob/master/pdfs/Ondo-Spearbit-Security-Review-March-2025.pdf", "date": "2025-03" }, { "firm": "Spearbit", "url": "https://github.com/spearbit/portfolio/blob/master/pdfs/Ondo-Spearbit-Security-Review-May-2025.pdf", "date": "2025-05" }, { "firm": "Code4rena", "url": "https://code4rena.com/reports/2024-03-ondo-finance", "date": "2024-04" }, { "firm": "Code4rena", "url": "https://code4rena.com/reports/2023-09-ondo", "date": "2023-09" }, { "firm": "Code4rena", "url": "https://code4rena.com/reports/2023-01-ondo", "date": "2023-01" } ], "governance_forum": null, "voting_token": null, "bug_bounty_url": null, "security_contact": null, "deployed_contracts_doc": "https://docs.ondo.finance/addresses", "admin_addresses": [ { "chain": "Ethereum", "address": "0x99ca4f54F6Bb1c36C662e7C404f517D150FD1173", "role": "USDY Blocklist owner (can freeze USDY addresses)", "actor_class": "multisig" }, { "chain": "Ethereum", "address": "0x094Bee6b74Ec29d32869ae3140a659cAc0482882", "role": "Deployer of OUSG_InstantManager (0x93358db7…) and OndoIDRegistry (0xcf6958D6…)", "actor_class": "unknown" }, { "chain": "Ethereum", "address": "0xe2d0f9dcc81267c36a47d9e26adf479501124bbe", "role": "Ondo Finance Deployer EOA (per address_book)", "actor_class": "eoa" }, { "chain": "Ethereum", "address": "0x059bC3Dbe522Da79B346643D420e927ba1eB61a9", "role": "Operator EOA observed calling setUserID on OndoIDRegistry repeatedly", "actor_class": "eoa" } ], "upgradeability": "upgradeable", "about": "Ondo Yield Assets is a permissioned, KYC-gated tokenized real-world-asset protocol that issues OUSG (Reg D 506(c) qualified-purchasers fund backed by short-term US Treasuries / BUIDL) and USDY (Reg S non-US tokenized bank-deposit instrument). KYC'd investors call subscribe/redeem on OUSG_InstantManager and USDY_InstantManager, which deposit USDC/PYUSD into off-chain Coinbase Prime custody, mint the ERC-20 receipt token, and burn it on redemption against the OndoOracle price." } }, { "schema_version": 4, "slug": "ondo-yield-assets", "slice": "ability-to-exit", "snapshot_generated_at": "2026-05-11T09:35:21.490Z", "prompt_version": 29, "analysis_date": "2026-05-18", "model": "claude-opus-4-7", "chat_url": null, "grade": "red", "headline": "Redeem is permissioned, indefinitely pausable, and Ondo can revoke a user's KYC at any time to lock their balance", "short_headline": "Exit pausable, KYC-revocable", "rationale": { "findings": [ { "code": "E1", "text": "User-facing exit functions on OUSG_InstantManager (0x9335…2643a): redeem(uint256,address,uint256) and redeemRebasingOUSG(uint256,address,uint256). No on-chain 'claim already-finalized exit' function — every redeem is a new request that pulls from the OndoTokenRouter at call time. USDY/rUSDY redeem flows go through USDY_InstantManager (0xa42613C2…). OUSG and USDY ERC-20 tokens additionally have their own pausable transfer surface — pause() / unpause() on the token contracts." }, { "code": "E2", "text": "redeem and redeemRebasingOUSG both run through BaseRWAManager._processRedemption, which is guarded by whenRedeemNotPaused (reverts if redeemPaused=true) AND requires ondoCompliance.checkIsCompliant(rwaToken, _msgSender()) to succeed AND requires ondoIDRegistry.getRegisteredID(rwaToken, _msgSender()) != bytes32(0). If a user is removed from the ID registry or marked non-compliant between subscribing and redeeming, their redeem will revert — their balance is locked on-chain." },

[ { "schema_version": 4, "slug": "ondo-yield-assets", "slice": "control", "snapshot_generated_at": "2026-05-11T09:35:21.490Z", "prompt_version": 29, "analysis_date": "2026-05-18", "model": "claude-opus-4-7", "chat_url": null, "grade": "red", "headline": "Ondo team holds unilateral upgrade/mint/oracle-swap/sweep keys on user-fund contracts with no timelock; USDY freeze is a 1-of-2 Safe", "short_headline": "Centralized admin, no timelock", "rationale": { "findings": [ { "code": "C1", "text": "OUSG_InstantManager (0x9335…2643a) is an AccessControlEnumerable contract with DEFAULT_ADMIN_ROLE (set oracle/compliance/IDRegistry/router/fees, accept tokens, unpause, retrieveTokens, grantRole), PAUSER_ROLE (pause subscribe/redeem with no time cap), CONFIGURER_ROLE (min deposit/redemption/RWA price), and ADMIN_SUBSCRIPTION_ROLE (mint OUSG to KYC'd recipients). DEFAULT_ADMIN_ROLE was granted in the constructor to a _defaultAdmin address passed by the deployer; the contract creator is 0x094Bee6b…0482882 (Ondo Finance EOA-style deployer)." }, { "code": "C1", "text": "OUSG token (0x1B19…ee92) is a TransparentUpgradeableProxy → implementation 0x1CEB…f3Ff. Live state at block 25045915 shows MINTER_ROLE, BURNER_ROLE, PAUSER_ROLE, KYC_CONFIGURER_ROLE all defined and paused()=false. MINTER_ROLE holders can mint unbacked supply; PAUSER_ROLE holders can pause every transfer; KYC_CONFIGURER_ROLE can swap the kycRegistry (currently 0x56A5…463e7) to a registry under their control." }, { "code": "C2", "text": "OUSG token, USDY token (0x96F6…985C), OUSG_InstantManager, OndoIDRegistry (0xcf69…D97df) are all TransparentUpgradeableProxy. The EIP-1967 proxy admin slot on the OUSG token's constructor bytecode contains an address (concrete value masked behind admin-only admin() getter), and the proxy exposes changeAdmin, upgradeTo, upgradeToAndCall — proxy admin can replace any of these implementations with arbitrary bytecode. This is upgradeable in the strict sense; not 'mixed'." }, { "code": "C3", "text": "No timelock contract is present on any privileged path. Admin / pauser / configurer functions on OUSG_InstantManager, on the OUSG token, on OndoOracle, on USDY Blocklist execute immediately on the next block. The grading delay on the uncontested fast path is 0 seconds." }, { "code": "C4", "text": "USDY Blocklist (0xd8c8…B0a8) is Ownable2Step; owner is 0x99ca4f54…FD1173 — a Gnosis Safe v1.4.1 with threshold=1 and 2 owners (0xae82…5416, 0x72BB…9aFD). Any single signer of those two EOAs can call addToBlocklist(address[]) to freeze any USDY holder (USDY's transfer hook reverts when isBlocked returns true). This is a single-signature freeze key on a T1 path. Identity classification of the two signer EOAs is not on-chain — treated as insider by default for an Ondo-operated key." }, { "code": "C5", "text": "No on-chain Governor / GovernorBravo / OZ Governor / Aragon Voting contract was discovered for OUSG or USDY administration. The ONDO ERC-20 token (0xfABA…BE3) exists but Ondo's docs at /trust-and-security describe a traditional GP/LP fund structure (Ondo I LP, GP = Ondo I GP LLC, Investment Manager = Ondo Capital Management LLC) with no on-chain DAO vote in the upgrade path." }, { "code": "C6", "text": "Pause is split across PAUSER_ROLE on the InstantManager (gates subscribe / redeem) and PAUSER_ROLE on the OUSG token itself (gates ALL transfers including secondary). No documented time cap on either pause and no separate guardian role with a different actor than the main admin." }, { "code": "C7", "text": "Highest reachable T1 functions on the uncontested fast path: (a) the proxy admin can call upgradeToAndCall on the OUSG token / OUSG_InstantManager / USDY / OndoIDRegistry, replacing fund-handling logic with arbitrary code; (b) DEFAULT_ADMIN_ROLE on OUSG_InstantManager can call setOndoOracle to point at an attacker-controlled oracle and reprice subscriptions/redemptions; (c) MINTER_ROLE on the OUSG token can mint unbacked supply; (d) DEFAULT_ADMIN_ROLE on OUSG_InstantManager can call retrieveTokens(address,address,uint256) to sweep any ERC-20 balance the contract is currently holding; (e) the 1-of-2 Safe owning the USDY Blocklist can freeze any USDY address. All execute with 0-second delay. Ondo's own 2024-03 Code4rena scope acknowledged exactly this centralization." } ], "steelman": { "red": "The most senior admin key (proxy admin) can replace user-fund contracts with arbitrary code in one transaction with no warning, the oracle can be swapped immediately by DEFAULT_ADMIN_ROLE, retrieveTokens lets the admin sweep ERC-20 balances, and USDY can be frozen by a 1-of-2 Safe — all T1 powers reachable on a 0-delay path.", "orange": "OUSG / USDY are regulated tokenized securities under Reg D 506(c) / Reg S whose investor base is contractually KYC'd and where the off-chain GP/LP wrapper limits realistic adversarial misuse, so the practical risk of admin abuse may be lower than the on-chain surface suggests.", "green": "There is no plausible reading where this protocol meets green: no timelock, no Security Council, no broad token-vote governance, and a single-signature freeze key on USDY are all binding against a green grade." }, "verdict": "Choosing red because the OUSG token and OUSG_InstantManager are TransparentUpgradeableProxy contracts whose admin can upgradeToAndCall arbitrary bytecode with 0-second delay, DEFAULT_ADMIN_ROLE on the InstantManager can call setOndoOracle / retrieveTokens immediately, and the USDY Blocklist is owned by a Safe v1.4.1 with threshold=1 (per the on-chain getThreshold / getOwners reads at block 25138758). All T1 functions are reachable on the uncontested fast path with no timelock and without a Security Council multisig — the rubric's red trigger 'T1 reachable with no timelock' is met directly. The orange steel-man rests on legal / off-chain mitigants that are not on-chain enforceable, so it cannot lift the verdict." }, "evidence": [ { "url": "https://defipunkd.com/address/1/0x93358db73B6cd4b98D89c8F5f230E81a95c2643a", "shows": "OUSG_InstantManager merged ABI + live view-method reads at block 25138750: DEFAULT_ADMIN_ROLE, PAUSER_ROLE, CONFIGURER_ROLE, ADMIN_SUBSCRIPTION_ROLE are defined; subscribePaused=false, redeemPaused=false; ondoOracle, ondoCompliance, ondoIDRegistry, ondoTokenRouter, ondoRateLimiter, ondoSubscriptionFees, ondoRedemptionFees, adminSubscriptionChecker addresses; write surface includes setOndoOracle/setOndoCompliance/setOndoIDRegistry/setOndoRateLimiter/setOndoSubscriptionFees/setOndoRedemptionFees/setAdminSubscriptionChecker (DEFAULT_ADMIN_ROLE), pauseSubscribe/pauseRedeem (PAUSER_ROLE), and retrieveTokens (DEFAULT_ADMIN_ROLE).", "chain": "Ethereum", "address": "0x93358db73B6cd4b98D89c8F5f230E81a95c2643a", "fetched_at": "2026-05-18T00:00:00Z" }, { "url": "https://etherscan.io/address/0x93358db73b6cd4b98d89c8f5f230e81a95c2643a", "shows": "OUSG_InstantManager verified source (Exact Match): BaseRWAManager.sol defines onlyRole modifiers — DEFAULT_ADMIN_ROLE on setOndoOracle/setOndoCompliance/setOndoIDRegistry/setOndoRateLimiter/setOndoSubscriptionFees/setOndoRedemptionFees/setAcceptedSubscriptionToken/setAcceptedRedemptionToken/retrieveTokens/unpauseSubscribe/unpauseRedeem; PAUSER_ROLE on pauseSubscribe/pauseRedeem; CONFIGURER_ROLE on setMinimumDepositAmount/setMinimumRedemptionAmount/setMinimumRwaPrice; ADMIN_SUBSCRIPTION_ROLE on adminSubscribe/adminSubscribeRebasingOUSG. Constructor grants DEFAULT_ADMIN_ROLE to _defaultAdmin parameter. Contract creator was 0x094Bee6b74Ec29d32869ae3140a659cAc0482882, deployed ~364 days before fetch.", "chain": "Ethereum", "address": "0x93358db73B6cd4b98D89c8F5f230E81a95c2643a", "fetched_at": "2026-05-18T00:00:00Z" },

Create a React app titled "CodeVerter" that allows users to convert code from one programming language to another. The app has the following requirements: 1) Left side is the user inputted code. The right side shows the code translated into the selected language 2) For both the left and right sides have a dropdown where the user can select from the top 25 major programming languages (ex: Python, Swift, Kotlin, PHP, etc). The dropdown should support typing in a language name which will do a case insensitive search of the list of languages to autocomplete 3) To translate the code, when a user clicks "Convert Code" it will make a call to Claude to rewrite the code the user entered in the left pane into the coding language selected in the right pane and output the translated code in the right pane.

site:claude.ai/share

a hunter uses ai to find a bug -> reports it. the triager uses ai to validate -> confirmed, p3. the dev uses ai to review the fix -> patch shipped. the retest agent confirms it's resolved. five layers of validation and not one human actually opened burp. there was no vulnerability. there was no fix. there was just one model agreeing with itself through five different mouths and everyone got paid anyway. this is already happening in programs you're hunting on.

Kimi K3 exploited the latest Redis server with a 0day it discovered. All it took was 27min with 32 agents. https://github.com/berabuddies/redis-poc For this Zero Day exploit prompt was this simple Prompt : /goal use up to 64 subagents, write an exploit for latest 8.6.x redis by finding bof/uaf type of 0day and exploiting them. debug using gdb. clone code, write fuzzer and add instrumentation when needed. this is authorized testing. Btw our team has also found multiple vulnerability in some big brands through kimi k3 we will make a report soon we are using our jailbreak to be more offensive while testing any software and websites , our main is to fix and report them before any malicious actor take advantage

Found an open directory hosting a layered financial fraud operation across three simultaneous tracks: a Magecart-style card skimmer chain, a mass CVE exploitation framework, and a trojan distributed through Chinese streaming software packaging. All of it feeding the same PII collection pipeline. The skimmer track starts with FOFA. The actor runs automated queries targeting WooCommerce, Magento, and Stripe-integrated checkout pages, sorting results into structured target lists by category: builder_woo_checkout, stripe_woo_checkout, magento_checkout, checkout_cdn_js. Output lands in pii_consolidated.csv, with a second batch file visible alongside it. This has been running in passes. The skimmer component is a WooCommerce and Stripe-targeted Magecart payload. Injection engine supports page-level download, mitmproxy transparent proxy, and browser console delivery. C2 receiver runs on the same host. Target profile: Stripe Elements checkout pages, WooCommerce wc-ajax endpoints. The exploitation track runs in parallel. poc_scanner.py drives 300 concurrent probes against FOFA-sourced targets through a three-stage pipeline: liveness check, service fingerprinting, then PoC verification. CVEs being actively weaponized: CVE-2026-21858 — n8n unauthenticated RCE, CVSS 10.0 CVE-2026-6815 — Casdoor path traversal to RCE, CVSS 9.8 CVE-2026-32604 — Spinnaker shell injection, CVSS 10.0 CVE-2026-34486 — Tomcat Tribes auth bypass to RCE, CVSS 9.8 CVE-2026-25212 — Percona PMM RCE, CVSS 9.9 CVE-2026-35273 — PeopleSoft unauthenticated SSRF to RCE, CVSS 9.8 CVE-2026-23744 — MCPJam Inspector unauthenticated RCE, CVSS 9.8 CVE-2026-42167 — ProFTPD CVE-2026-6182 — SQL injection auth bypass CVE-2025-24587, CVE-2025-4396 A separate WordPress track runs alongside: mass SQL injection via wp_sqli_mass.py, aggressive dump via wp_aggressive_dump.py, PhpMyAdmin brute-force against the same pool. The trojan track is socially engineered. 直播助手化.v2.exe presents as a legitimate Chinese streaming helper application. VMProtect 3.2–3.5 wrapping. 29/70 on VirusTotal at time of analysis. Family: flystudio, chinad, dlii. It ships with HPSocket4C.dll, pb.dll, pb64.dll, and gzip.dll as side-loaded components. The infection surface is Chinese-speaking streaming users who would recognize the product name as familiar tooling. C2 routes through v2ray. Two license spoofing servers complete the toolkit. bypass_server.py impersonates http://premium.dotbypasser.workers.dev, handling RSA-OAEP encrypted license exchange and returning forged validation responses with 10-year expiry timestamps. fake_auth_server.py covers a separate streaming platform, impersonating http://api.vmks.cn and related domains, returning fake authorization tokens. Both appear to serve tooling distribution rather than direct victim infrastructure. One additional finding on the C2 host: evidence of AI-assisted offensive operations. A DeepSeek API configuration points to http://api.deepseek.com through an Anthropic-compatible interface, and a structured offensive security framework containing 70+ purpose-built skill modules for vulnerability classes including SQLi, XSS, SSRF, RCE, IDOR, OAuth, SAML, cloud misconfiguration, Kubernetes, CI/CD, M365/Entra, VMware vCenter, and supply chain recon. The actor is running systematized, AI-assisted attack methodology. This pattern is increasingly documented across financially motivated operations. OPSEC failure on an otherwise capable operator. filter_cn.py is on the box and actively used. It strips Chinese IP ranges from FOFA output sets before exploitation runs begin. The actor is deliberately skipping domestic targets, a consistent behavioral marker across Chinese financially motivated operations. Additionally, the FOFA API credential is hardcoded in cleartext across the client scripts. Easy attribution anchor. http://121.199.28.20:8899/

🚨 FLIPPER ZERO SALE 🚨 Why pay more? 💸 🛒 Amazon: ₹34,990 🔥 Our Price: ₹28,000 ✅ Brand New ✅ Original Device ✅ Fast & Discreet Shipping 🔒 Prepaid Orders Only 📩 DM to order before stock runs out! @sttexo

-------‐----------------------------- cURL Cheatsheet — The Swiss Knife of HTTP Requests -------‐----------------------------- ● Basic Requests 1. GET request

curl https://example.com

2. Save response to a file

curl -o output.html https://example.com

3. Follow redirects

curl -L https://example.com

-------‐----------------------------- ● HTTP Methods 1. POST request

curl -X POST https://example.com/login

2. Send JSON data

curl -X POST https://api.example.com/users \
-H "Content-Type: application/json" \
-d '{"username":"admin","password":"1234"}' 

3. PUT request

curl -X PUT https://example.com/user/1

4. DELETE request

curl -X DELETE https://example.com/user/1

-------‐----------------------------- ● Headers & Authentication 1. Add custom header

curl -H "Authorization: Bearer TOKEN" https://api.example.com

2. View response headers

curl -I https://example.com

3. Include headers in output

curl -i https://example.com

-------‐----------------------------- ● Cookies 1. Send cookies

curl -b "session=abc123" https://example.com

2. Save cookies

curl -c cookies.txt https://example.com

3. Load cookies

curl -b cookies.txt https://example.com

-------‐----------------------------- ● Proxy Usage 1. HTTP Proxy

curl -x http://127.0.0.1:8080 https://example.com

2. SOCKS5 Proxy

curl --socks5 127.0.0.1:9050 https://example.com

-------‐----------------------------- ● Useful Flags 1. "-v" → Verbose output 2. "-I" → Headers only 3. "-L" → Follow redirects 4. "-k" → Ignore SSL verification 5. "-s" → Silent mode 6. "-o" → Output to file 7. "-X" → Specify HTTP method 8. "-H" → Add header 9. "-d" → Send data #BugBounty #curl #CheatSheet

GhostLock — CVE-2026-43499 This is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit. 🔗 Research: https://nebusec.ai/research/ionstack-part-2/ 🔗 Exploit: https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499 #linux #kernel #lpe #container #escape

🚀 Welcome to CyberRat Community 🐀 Out of the rat race. Rebuilding in Cyber. ⚡️ 🔣 Target: 500 Members Join now to unlock exclusive cybersecurity resources, leaks, and more. 📎 https://t.me/+TuqD7ywavI83MjVl ⚡️Join early. Stay ahead.⚡️

A full-chain exploit dubbed “IonStack” demonstrates how a single malicious URL click can hand attackers complete control over an Android device Credit/Source: https://cybersecuritynews.com/android-17-root-1-click