THORChain Targets Rujira Restart With v3.21 Exploit Fix

THORChain said its v3.21 upgrade patches the FIN contract exploit on Rujira and will allow the halted App Layer to restart. The network is targeting block 28,366,100, expected around Friday, Oct. 23, according to its release notes.

The restart would reopen trading, lending, borrowing and automated trading on Rujira. Its products run through smart contracts within THORChain, rather than on a separate blockchain. An App Layer halt can stop those contracts without stopping THORChain's Base Layer, Rujira explains.

“This lets the App Layer be unhalted,” THORChain said. Reopening still requires a separate step: Rujira said on Oct. 15 it would ask THORChain node operators to lift the pause following a successful upgrade. The block height determines upgrade timing; the calendar date is an estimate.

Rujira reported the exploit on Sept. 26, saying an attacker transferred a custom concentrated liquidity, or CCL, position without owning it. The team said it paused the App Layer with node operators' support, and that only one position, belonging to the Rujira team, was affected. It said no user funds were lost.

CCL is a market-making strategy that supplies liquidity within a user-defined price range, according to Rujira's documentation. Rujira attributed the exploit to a vulnerability in the position-transfer function, not CCL's trading logic.

In a Sept. 27 update, Rujira said the fix was at the Base Layer level and was already scheduled for v3.21. The release notes say the upgrade uses a private binary containing additional security patches.

Borrowers Face a Restart Window

Rujira's Oct. 15 plan calls for a conditional grace period: if any Credit Account position is above 100% loan-to-value and eligible for liquidation when the App Layer is ready to resume, it will ask node operators to keep the Credit Account contract paused for another 24 hours. That would give affected borrowers time to add collateral before liquidations resume.

Borrowers can already add collateral through Rujira Borrow or by sending assets directly to their Credit Account address, the team said. Rujira warned on Oct. 10 that positions still unsafe after the grace period can be liquidated when a liquidator triggers the process.