auditing

According to official news, the smart contract auditing platform Code4rena has announced that it will gradually cease operations, and the Web3 security company Immunefi will take over its clients and security researchers. Code4rena posted on social media that it has made the decision to shut down and stated that all ongoing competitions and bounty activities will be completed as usual, and existing collaborations will be "properly concluded." Immunefi stated that it will assist in migrating Code4rena's bounty projects, reward structures, and researchers to its platform.Code4rena is known for its "competitive auditing" model, where independent researchers compete to find vulnerabilities in smart contracts for rewards. This shutdown comes less than two years after blockchain security company Zellic acquired Code4rena in 2024. Previously, Code4rena raised $6 million from Paradigm in 2023 for auditing incentives and platform expansion.This shutdown comes at a difficult time for DeFi protocols and the security sector. Data from DefiLlama shows that there were over 20 crypto vulnerability incidents in April alone, setting a monthly record. JPMorgan analysts believe that ongoing DeFi security incidents are limiting major institutional investors from entering the market. Meanwhile, the total value locked in DeFi has decreased from about $160 billion in October to approximately $83 billion currently.

According to Theblock citing The Information, Polymarket has launched an audit targeting application startups that promise to help users track suspected insider trading activities.The report states that these copy trading applications provide customers with a list of traders on the Polymarket platform who have a good track record of profitability, or highlight some unusually large or oddly timed bets that may be based on confidential information. Customers can use bots to replicate these trades or receive notifications of seemingly good trades. These applications charge service fees.It is reported that Polymarket and its main competitor Kalshi have both been scrutinized for insider trading issues. Last month, Polymarket introduced clearer rules regarding insider trading and its enforcement.

Aave Labs announced the security framework for Aave V4, proposing a "security-first" development model that embeds security verification during the architectural design phase, rather than only conducting a final audit before launch.This security plan has been ongoing for about a year, with approximately 345 days of security reviews completed, funded by a $1.5 million security budget approved by the Aave DAO. It is reported that the V4 security process combines multiple auditing methods, including formal verification, manual audits, invariant testing, fuzzing, and public security competitions. Future protocol development will continue to adopt five long-term security measures, including introducing formal verification early in development, implementing multi-layer security auditing methods, continuous validation mechanisms, a long-term bug bounty program, and utilizing AI-assisted smart contract security scanning.

The Lighter team announces that its perpetual and spot trading zk circuits have completed auditing and are officially open-sourced. The team has released the complete verification code, allowing external independent verification of every order, cancellation, and settlement operation of Lighter L2 on Ethereum to ensure their authenticity and validity.Developers can generate ZkLighterVerifier using build scripts from GitHub and perform consistency checks with the deployed contracts on Ethereum.

ChainCatcher message, UXLINK has released the latest progress on the UXLINK token contract migration: Currently, there is unauthorized issuance of UXLINK tokens, which not only violates the content of the UXLINK white paper but also undermines community consensus. Communication has been established with major CEX partners regarding the planned token swap, and they have all expressed full support.A new smart contract has been submitted for security auditing. This new contract will set a fixed token supply to ensure that no additional tokens will be issued. At the same time, the usual mint-and-burn function, which is intended to protect community interests in cross-chain solutions, has been canceled. It is also responding to inquiries from the Digital Asset Exchange Association (DAXA) in South Korea and will collaborate with security expert partners to draft a comprehensive incident report. Previously, UXLINK stated that a multi-signature wallet had encountered a security vulnerability, resulting in the illegal transfer of funds.

ChainCatcher news, Sun Deji, the chairman of the Hong Kong Institute of Accountants and Financial Reporting, stated in a recent interview that according to the "Stablecoin Ordinance" effective August 1 in Hong Kong, stablecoin licensees are required to undergo independent audits annually to ensure transparency and compliance. It is expected that Hong Kong will only introduce comprehensive stablecoin auditing and accounting guidelines in 1 to 3 years.Sun Deji also revealed that the Hong Kong Financial Reporting Council may indirectly participate in the regulation of stablecoins, and the prudent regulatory strategy for stablecoins is expected to be similar to the licensing of virtual banks (now known as digital banks) in the past, clarifying how to audit licensed institutions and how to recognize, measure, and disclose in financial statements.

ChainCatcher message, the DeFi protocol Nemo on Sui has released an incident report stating that due to a security vulnerability in the flash_loan and get_sy_amount_in_for_exact_py_out functions in the contract, it was exploited by attackers, resulting in an asset loss of approximately 2.59 million USD.The attack originated from the developers launching new features without sufficient auditing and failing to promptly address known risks. The main funds were transferred to Ethereum via a cross-chain bridge, and the core functions of the protocol have currently been frozen. A vulnerability patch has been submitted for emergency auditing, and the team is formulating user compensation and asset tracking plans.

ChainCatcher news, according to Cointelegraph, the stablecoin project USDKG supported by the Kyrgyzstan government announced the advancement of its fiatization process, which adopts a dual-anchor mechanism of gold reserves and the US dollar. William Campbell, the head of advisors, revealed to Cointelegraph that although this stablecoin is backed by physical gold, it chooses to anchor the exchange rate to the US dollar (1:1), aiming to meet the needs of daily payments and international trade. The gold reserves will be audited every six months by one of the Big Four accounting firms and publicly disclosed on-chain.The Kyrgyzstan government is actively laying out its Web3 strategy through legislative reforms and tax reductions, with 140 crypto enterprises already registered. As a key component of the national digital economy development, USDKG is supported by government-provided gold reserves, but its operational management is independently executed by private entities. The project team stated that in the future, it will integrate DeFi lending and yield farming functions to compete with traditional stablecoins like USDT through differentiated trust endorsements.USDKG plans to officially launch in the next quarter, allowing users to verify gold reserves through on-chain audit reports. Kyrgyzstan is gradually building a Central Asian digital asset hub by lowering tax rates for crypto enterprises and establishing a clear regulatory framework.

ChainCatcher message, Loopscale has released an update on the hacking incident on platform X, disclosing that the withdrawal logic and vulnerability patches have been audited by the security company Sec3 and an independent auditor. The Vault withdrawal function will be reopened to all users at 10:00 AM Eastern Time tomorrow, and the incident analysis report will also be published. To maintain the stability of the protocol, a temporary 24-hour withdrawal limit is expected to be implemented for each user.

ChainCatcher news, Sun Yuchen stated in his live broadcast that he has called for FDT to hire a third-party auditing firm for an audit, "I believe the audit results will show that FDT is in a state of insolvency."

ChainCatcher news, according to official news, Tether has appointed Simon McWilliams as Chief Financial Officer, responsible for financial auditing.McWilliams has over 20 years of experience leading large investment management firms through rigorous audits and will be responsible for advancing Tether's commitment to further enhance transparency and regulatory compliance.

ChainCatcher news, Jup iter founder Meow published a long article outlining the future development plan and long-term strategy for the JUP token. Meow proposed the "GOAT framework" (Governance, Transparency, Organic, Collaboration) as the core and announced three key initiatives:First, an independent auditing agency will be commissioned to conduct a comprehensive audit of the founders, treasury, and tokens, with all results to be publicly disclosed on the new official website jup.com to enhance transparency. Second, the establishment of the "Litterbox Trust Fund," committing to inject 50% of the protocol's revenue into this fund over the next two years for strategic accumulation of JUP. Finally, Meow proposed the 2030 Incentive Plan, voluntarily using 280 million JUP held personally for new team incentives, and promised not to claim any tokens before 2030, with the final eligibility for a 500 million JUP reward entirely dependent on community voting results regarding his performance.Jup iter also disclosed three major business pillars: the aggregation trading platform Jup.ag, the community ecosystem Jup iverse, and the cross-chain network Jup net, emphasizing that the token mechanism will bind the long-term interests of ecosystem participants. Meow stated that these series of initiatives aim to demonstrate the team's determination to advance together with the community, breaking the inertia of short-term profit-seeking in the crypto industry, and fully committed to building "the future value network belonging to Jup iverse." Currently, the relevant proposals have been submitted for DAO discussion, and final implementation requires community voting approval.

ChainCatcher news, according to Jinshi reports, the Associated Press disclosed that the U.S. Treasury Department's Inspector General has begun an audit of Musk's Department of Government Efficiency (DOGE) team's access to the federal government payment system.

ChainCatcher news, Cactus Custody officially launches the Cactus mobile auditing tool, combining Passkey and PWA (Progressive Web App) to break free from device limitations.The Cactus mobile auditing tool supports Passkey + UKey, device fingerprint binding, and Face ID one-touch authorization, achieving efficient and secure mobile approvals. It features plug-and-play, minimalist binding, efficient approval, intelligent push notifications, and multi-account support.As one of Asia's trusted institutional-grade digital asset custodians, Cactus Custody has obtained ISO certification and holds a Hong Kong license (No. TC006789), while also receiving a temporary exemption from the Monetary Authority of Singapore (MAS). Cactus Custody strictly adheres to capital reserve standards and anti-money laundering and counter-terrorism financing regulations, simplifying digital asset management with professionalism and confidence, and always upholding the mission of "safety first, integrity-based," providing comprehensive protection for users' digital assets.

ChainCatcher message, the L1 blockchain Initia built on Cosmos SDK, tweeted that its mainnet release code has been officially frozen and is currently undergoing a security audit.

ChainCatcher news, according to The Block, the auditing firm Prager Metis has reached a settlement with the U.S. Securities and Exchange Commission (SEC), agreeing to pay $1.95 million to resolve allegations of negligence in its audit of the now-defunct cryptocurrency exchange FTX.The SEC accused Prager Metis of making "false statements" about FTX's financial condition in two audit reports submitted between February 2021 and April 2022, failing to comply with Generally Accepted Auditing Standards (GAAS). Additionally, the firm did not adequately disclose the potential risks associated with the relationship between FTX and Alameda Research.

ChainCatcher news, according to The Block, blockchain security audit provider Zellic has acquired the smart contract auditing platform Code4rena. This is its first acquisition, aimed at providing clients with more comprehensive security review services.The CEO of Code4rena stated that it will continue to operate independently.