Huma Finance (HUMA)

BREAKING: Someone just put up 10,000,000 $HUMA as collateral on @jup_offerbook. Looking to borrow 128,157 USDC at 6.4% APY for 30 days. For Lenders: This is your window. Offer expires in 6d 13h. @humafinance

BREAKING: Someone just put up 10,000,000 $HUMA as collateral on @jup_offerbook. Looking to borrow 128,157 USDC at 6.4% APY for 30 days. For Lenders: This is your window. Offer expires in 6d 13h. @humafinance

BREAKING: Someone just put up 10,000,000 $HUMA as collateral on @jup_offerbook. Looking to borrow 128,157 USDC at 6.4% APY for 30 days. For Lenders: This is your window. Offer expires in 6d 13h. @humafinance

BREAKING: Someone just put up 10,000,000 $HUMA as collateral on @jup_offerbook. Looking to borrow 128,157 USDC at 6.4% APY for 30 days. For Lenders: This is your window. Offer expires in 6d 13h. @humafinance

📁 PayFi Ecosystem | ├ 📁 On-Chain Credit & Receivables | | |- 📁 $HUMA (Huma Finance) | |- 📁 $CPOOL (Clearpool) | |- 📁 $PST (PayFi Strategy Token) | |- 📁 $CC (Canton Network) | |- 📁 $RIO (Rio) | ├ 📁 Streaming & Programmable Payments | | |- 📁 $ZBCN (Zebec Network) | |- 📁 $TEL (Telcoin) | |- 📁 $VELO (Velo) | |- 📁 $SHX (Stronghold) | |- 📁 $GC (GreenPay) | ├ 📁 Fiat-Crypto Gateways & Merchant | | |- 📁 $ACH (Alchemy Pay) | |- 📁 $RTX (Remittix) | |- 📁 $DASH (Dash) | |- 📁 $REAL (RealLink) | |- 📁 $BNB (BNB Chain) | ├ 📁 Cross-Border Remittance & Rails | | |- 📁 $XLM (Stellar) | |- 📁 $XRP (Ripple) | |- 📁 $TRX (Tron) | |- 📁 $SOL (Solana) | |- 📁 $ALGO (Algorand) | └ 📁 RWA & Yield-Bearing Liquidity | |- 📁 $ONDO (Ondo Finance) |- 📁 $STABLE (Stable Protocol) |- 📁 $HBAR (Hedera) |- 📁 $XDC (XinFin) |- 📁 $ADA (Cardano)

$HUMA looks ready to send.. I’m already positioned and watching for a breakout push from this. if momentum kicks in, this could move fast. DYOR,NFA.. https://t.co/jvCDtC20DM

https://t.co/oX6NItgK0p

Today, we have been working closely with @blockaid_ to thoroughly investigate the vulnerability attack on the @humafinance v1 protocol that occurred last night. Blockaid's incident analysis report is very detailed (link in the first reply), and we will not repeat it here. Below is the TL;DR of the incident and the lessons we learned about system architecture and operations. 👇 TL;DR Attack incident: The attacker discovered a vulnerability in the smart contract and stole about $101,000 of protocol fee & pool owner fee from three old v1 pools on Polygon. User funds: User funds were not affected at all. Risk isolation: The issue was with the Huma EVM v1 contract and is completely unrelated to PST and all Huma smart contracts on Solana. Solana contract: The program on Solana uses a completely redesigned architecture and does not contain the compromised logic. Current status: All v1 pools have been paused. Key lessons: On the surface this appears to be a smart‑contract bug in the v1 version launched early 2023, but it highlights several issues in protocol design and operations. 1. Do not mix important state transitions into functions with complex logic. _updateDueInfo() and _getDueInfo() calculate due amounts and various fees and are the most complex parts of the v1 contract. Embedding borrower state transitions into these complex functions is not a wise choice. We later became dissatisfied with this design and abandoned it in the Huma v2 contract, opting for a simpler architecture. 2. Rigorously remove unnecessary features. requestCredit() was introduced to support future extensions but was never used in practice. Non‑critical functions receive less testing and security review, creating unnecessary attack surface. We discussed removing it before release but kept it, thinking it harmless. If a function is not required, it should not be placed in the contract. 3. Actively shut down pools that are no longer used. Keeping obsolete pools creates unnecessary risk. Today, both developers and attackers are actively using AI, and some old contracts have not undergone AI audit, potentially exposing more weak points. The work to shut down v1 pools had already begun but was not prioritized highest; we should be more decisive on this. This is a painful lesson. We must learn from it and not waste the high tuition fee. We share our immediate reflections and lessons here, hoping to help other ecosystem builders, especially projects with legacy contracts, to better protect against hackers. DeFi