XPR Network Suffers Devastating $9M Proton.swaps Exploit

XPR Network's proton.swaps suffered a devastating exploit on September 11, resulting in the loss of $9 million worth of liquidity. The attacker exploited a flaw in the withdrawal function, which accepted negative amounts, allowing them to manipulate internal balances before withdrawing real tokens.

The attack was swift and ruthless, with over $9 million stolen within just 11 minutes of its launch. The attacker targeted multiple asset pools, including XUSDC, XMD, METAL, LOAN, and bridged assets. A total of 2.12 billion XPR was touched, representing about 6.5% of the circulating supply.

Network producers identified the exploit and patched the contract in a timely manner, ultimately securing most of the stolen funds. The incident has raised concerns about weak input validation and its potential to amplify losses across interconnected liquidity pools.