permi

Doubao Mobile Assistant stated that the 30-day public announcement period for its "Screen Automation Operation Declaration Agreement" (SAEP) ended on October 14, 2026, and it will gradually lift the screen automation operation permissions for third-party applications. Applications that have explicitly declared refusal of operation permissions will not be operated by the agent.After the public announcement period ends, developers can still declare refusal at any time, and Doubao Mobile Assistant will provide feedback within 3 working days. This agreement is aimed at cross-application operations of graphical interface agents, allowing developers to declare their interaction strategies with the agent.

On October 8, the XRP Ledger activated the PermissionDelegationV1_1 feature, allowing account owners to authorize other accounts to perform specific tasks without relinquishing control of the account's master key. According to the monitoring site XRPL Dashboard, such upgrades require over 80% support from trusted validators for two consecutive weeks; based on the current 35 validators, at least 29 must support it. The countdown for this feature was reset in September due to the support rate falling below the threshold.This feature allows enterprises to split permissions by function. Stablecoin issuers can authorize compliant accounts to approve new customers while keeping the master key offline. Authorized accounts use their own keys to sign and can only perform the granted operations; owners can change or revoke these permissions at any time. Each authorized account can receive up to 10 permissions, which limit the types of operations they can perform, rather than automatically setting spending limits. Banks have previously separated payment and compliance responsibilities at the employee level, and this upgrade enforces such division at the ledger level.According to a report shared by Evernorth, a subsidiary of XRP Treasury, the network held an average of $3.72 billion in tokenized assets and $539 million in Ripple's RLUSD stablecoin in the second quarter, totaling approximately $4.26 billion. Official guidance advises users not to delegate PaymentBurn permissions before separately fixing activation; this permission is intended for assistants to destroy tokens but, under certain conditions, also allows for the creation of new tokens. This warning pertains to tokens issued on the ledger rather than newly minted XRP.

On September 8, the ZKsync development team Matter Labs announced that it has open-sourced the permission engine of its privacy blockchain platform Prividium for financial institutions under the Apache 2 license. This engine is responsible for managing roles and access permissions on the chain, determining who can read and write data. After the open-sourcing, institutions can run the permissioned chain in their own environment based on the public code without signing commercial agreements, and can independently inspect, run, and modify the core code, reducing reliance on a single vendor.The Deutsche Bundesbank became the first institution to test and deploy the open-source permission engine in its own infrastructure. Matter Labs stated that both parties will continue to collaborate on platform design and testing. Prividium achieves privacy by keeping transaction data within the institution, only recording zero-knowledge proofs that the ledger has been correctly updated on Ethereum or other compatible chains. Previously, the core of ZKsync OS, Atlas sequencer, Airbender prover, interoperability contracts, and block explorer and monitoring components have been open-sourced.Matter Labs CEO Alex Gluchowski stated that feedback from regulators indicated that relying solely on commercialized core components leads to unacceptable single vendor dependency, and the ability to run, inspect, and modify the code independently is a prerequisite for adoption. He also pointed out that this open-sourcing does not change the role of the ZK token, only adjusting which parts of the Prividium software are public code and which remain commercial products. Connectors such as management consoles, user access tools, and core banking system integrations remain paid products.

Bitcoin News posted on platform X stating that the Congressional Research Service pointed out in a new report that since 2017, with changes in presidential administrations, federal regulators have repeatedly changed their stance on whether banks can engage in cryptocurrency activities.The report states that Congress could clarify through legislation to explicitly allow or restrict specific activities to reduce the frequent adjustments in regulatory positions. The report mentions the CLARITY Act: the version passed by the House of Representatives would allow banks to use digital assets or blockchain for activities already permitted by current law; the version reported by the Senate committee would explicitly allow 11 types of cryptocurrency activities, including allowing banks to underwrite and trade digital assets more broadly.

The token standard on Solana and the NFT infrastructure Metaplex announced the launch of MPL-3643, positioned as a new standard for permissioned real-world assets (RWA) and tokenized securities, aimed at supporting the compliance infrastructure required for issuer-led tokenization.Metaplex stated that bringing new markets on-chain requires compliance infrastructure that can support issuer-led tokenization. MPL-3643 will be deployed on Solana, targeting real-world asset and tokenized securities scenarios that require permission control.

NVIDIA CEO Jensen Huang stated that the top priority is to strip AI entities of their privileges.

MistTrack disclosed that following the $1.46 billion hacking incident at Bybit last year, where nearly $1.2 billion in stolen funds were transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have once again flowed through THORChain.In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized and permissionless network.

Supermicro has now begun shipping rack systems equipped with NVIDIA Vera Rubin NVL72.

The PermissionDelegationV1_1 upgrade of the XRP Ledger entered a 14-day activation countdown on September 21, having received support from 29 of the 35 trusted validator nodes. If the support rate remains above 80% during this period, the upgrade could officially activate as early as October 5 at 11:18 UTC; at least 28 validator nodes must continue to support it, or the countdown will reset.This feature allows accounts to split permissions by role. For example, a stablecoin issuer can allow a connected compliance system to approve customer accounts holding its tokens while keeping the keys with full control offline; operational accounts can gain payment permissions but cannot change keys or delegate authority to others. Each trustee can have up to 10 permissions, and the main account can modify or revoke them at any time.This is the network's second attempt to introduce this feature. The original version had vulnerabilities that attackers could exploit to make others pay transaction fees with improperly signed transactions, and by repeatedly submitting high-fee transactions, they could deplete the victim's XRP balance. This vulnerability was reported by community testers on September 15, 2025, and validator nodes were advised to reject the amendment, so it was never activated. The fixed version was released with xrpld 3.3.0, changing the way unauthorized transactions are rejected, ensuring that fees are not deducted before signature verification.

Sandeep Nailwal, CEO of the Polygon Foundation, stated that Polygon is preparing to deploy a permissionless burn contract that allows anyone to permanently burn 100 million POL, which accounts for approximately 83% of the 121 million tokens held by the Polygon base fee collector. The contract is currently live on the testnet and will be deployed to the mainnet after the security committee completes the final signature.The first round of burns will permanently destroy 100 million POL, after which community members can trigger burns every quarter. Polygon's documentation indicates that the base fee is determined by the network and will be burned, with Nailwal stating that each base fee will inject POL into the collector. Based on the above data, approximately 21 million POL will remain in the collector after the initial burn.This burn represents about 1% of the initial supply of 10 billion POL, and based on a total supply of approximately 10.716 billion as shown by Blockscout, it accounts for about 0.93%. The burn will not set a hard cap on POL, which will continue to be issued, with an annual issuance rate of about 2% after June 2025. Nailwal also mentioned that POL has entered deflation starting January 2026, citing data from his "ChatGPT Analyst" that Polygon's revenue in 2026 will be $24.5 million, higher than Arbitrum's $8.41 million and Near's $5.6 million.

According to The Block, ZKsync developer Matter Labs has open-sourced the permission engine of its distributed ledger platform Prividium for financial institutions, allowing organizations to run, inspect, and modify core code in their own environments. The German central bank has become the first institution to test and deploy Prividium.Matter Labs CEO Alex Gluchowski stated that feedback from regulators regarding commercial core means reliance on a single vendor, and that open-sourcing the core "structurally eliminates adoption barriers."Other components of Prividium, such as the ZKsync OS core and Atlas sequencer, have previously been open-sourced. The permission engine is planned to operate as an independent component, allowing institutions to deploy it without a commercial agreement, but management tools and integration with existing systems remain commercial products. Gluchowski said, "The central bank running public code is the clearest signal in this direction."

DeFi protocol Term Labs updates on the progress of the attack incident, disclosing that the affected entity is the Term Vault governance mechanism, rather than the underlying Term protocol and its direct lending market. All Meta Vaults have now been closed and DAO governance permissions revoked to prevent further inflow of funds. This closure operation is irreversible and will permanently block new deposits.Currently, the withdrawal function remains open, and they are working with external security teams to conduct repairs and recovery. If a funding gap is ultimately confirmed, corresponding solutions will be explored. Term Labs reminds users to pay attention only to information released by official accounts and to be wary of impersonators and fraud. Previously, it was reported that Term Labs suffered a governance attack resulting in losses of approximately $8.5 million.

The Supreme Joint Military Command of Iran stated that any vessel passing through the Strait of Hormuz must obtain permission from Iran.

BIP-110 soft fork has stalled due to support rates far below standard, with thousands of nodes isolated. Just two days after the incident, the Bitcoin BIP editing team removed the editing privileges of the proposal leader Luke Dashjr on Monday. Editor Mark Erhardt proposed a motion for dismissal, citing reasons including conflicts of interest, minimal contributions, leading a controversial fork, and coordination breakdown.Supporters pointed out that Dashjr used his editing privileges to favor the BIP-110 proposal, assigning numbers and quickly merging PRs before discussions on the mailing list, and has contributed less than 1% since April 2024. The peak signal support for BIP-110 was only 2.53%, far from the 55% threshold, and the forced chain has stalled at a height of 961,633. Ocean was the only mining pool signaling before the fork, and has now resumed non-BIP-110 work. Dashjr announced the suspension of his roles as Chairman and CTO of Ocean four minutes before the dismissal confirmation, shifting to Bitcoin open-source projects, but still serves as the chief maintainer of Bitcoin Knots. The price of Bitcoin was unaffected by the incident.

According to the official report from Ostium, the core of this attack lies in the intrusion of the off-chain price reporting system's permissions, unrelated to smart contract vulnerabilities. After gaining off-chain authorization, the attacker submitted forged prices (5,000 USD and 60,000 USD) to the BTC-USD market using the legally registered forwarding paths of the protocol, completing an atomic open-close arbitrage cycle within the same transaction, and starting with a rolling scale of 100 USDC. Through 8 transactions, they extracted 23.75 million USDC from the OLP treasury within 5 minutes, until the treasury's circuit breaker mechanism was triggered.The root cause is the lack of a multi-party approval mechanism at the same level as on-chain multi-signature in the off-chain infrastructure, creating a single point of permission vulnerability. The stolen funds have been converted to ETH and mixed through Tornado Cash, and tracking efforts are still ongoing.

According to official news, Uniswap has launched Permissioned Pools, a new hook standard in Uniswap v4 that supports permissioned asset trading through automated market makers (AMM), with compliance enforced directly on-chain. Permissioned asset pools are collaboratively built by on-chain asset management teams. The first batch of partners includes Superstate, Securitize, and Dowgo.

GoPlus Security issued a security alert stating that a user signed a malicious Permit transaction 183 days ago, resulting in approximately $1,625 of USDC being transferred by a phishing attacker.Since the user did not revoke the relevant authorization afterwards, the attacker again used that authorization to transfer approximately $75,780 of USDC.

According to The Block, Hyperliquid announced that it will introduce a permissionless deployment mechanism for the HIP-4 outcome markets in future upgrades. According to the disclosure plan, validators will vote on outcome templates to ensure market quality and clarity of expression.In addition, HIP-4 market deployers are required to stake 500,000 HYPE and can receive up to 50% of the fee share from the markets they create.

Founder of Strategy Michael Saylor published a post opposing the BIP 110 proposal that restricts the use of inscriptions and other data storage purposes. Bitcoin should adhere to neutrality, open markets, and permissionless innovation, and should not target specific uses through consensus rules.Saylor listed 110 reasons for opposition, emphasizing that Bitcoin should remain conservative at its core. Bitcoin does not need guardians of purity; it needs guardians of neutrality.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.