Hyperliquid's HIP-3* upgrade adds optional onchain allowlists managed by deployers to restrict market access, and is available on testnet as of October 26, 2026

Overview Debates Related claims Topics Sources

The OpenZeppelin Contracts library underpins over $38 trillion in transferred digital asset value, including major stablecoins and tokenized funds

Founded in 2015, OpenZeppelin has conducted over 900 security engagements and uncovered more than 10,000 code vulnerabilities before production

Hyperliquid described itself as a neutral infrastructure layer where deployers retain control of and legal responsibility for their own permissioned markets

The standard HIP-3 framework, live since October 13, 2025, allows anyone staking 500,000 HYPE to deploy perpetual futures markets on Hyperliquid

S&P Global acquired OpenZeppelin to expand its capabilities in assessing technology layer risks for on-chain financial products and to develop new security benchmarks

On-chain Solidity verifiers for Groth16 and Plonk checks and applications whose proof aggregation ended in Groth16 or Plonk proofs were unaffected by SP1's high-severity soundness bug

The X100 protocol governance takeover attack on October 24, 2026 targeted assets held on the Ethereum blockchain, liquidating liquidity pools and treasury reserves

SP1 stores multidimensional data in Tensors, where SP1's native Rust verifier failed to check whether the number of stored elements matched the product of the tensor's declared dimensions

The X100 protocol exploit on October 24, 2026 was executed in two transactions that converted X100 protocol treasury tokens and liquidity positions into USDT

Security researcher Spreek identified four unexecuted malicious upgrade contracts deployed against Swell DAO's protocol that could have stolen approximately 2,500 ETH

The initial Aggregator Hook, built for Uniswap v4, went live in March 2026 on Tempo, a payment-focused blockchain developed by Stripe and Paradigm

Aggregator Hooks make liquidity from external decentralized exchanges appear as native Uniswap v4 pools to trading routers

Uniswap's UNIfication governance initiative, approved in December 2025, included a direct one-time treasury burn of 100 million UNI tokens

Uniswap founder Hayden Adams and Paradigm's Dan Robinson rejected 0x's September findings on malicious Uniswap v4 hooks, arguing that aggregators and routers are responsible for vetting and screening which hooks they route trades through

The external liquidity venues integrated at the Aggregator Hooks launch on October 22, 2026 include Curve, Fluid, PancakeSwap, and Slipstream

Aggregator Hooks connect seven external liquidity sources that account for over 90% of decentralized exchange activity across Ethereum, Base, and Robinhood Chain

Swaps using Uniswap v4's Aggregator Hooks feature block-refreshed price quotes, atomic single-transaction settlement, and preserve existing token approvals

0x engineer Duncan Townsend stated that 0x used Uniswap's allowlist and alleged that at least one malicious hook was included on the allowlist

Uniswap routing guidance updated on October 16, 2026, states that Uniswap's router requires manual allowlisting for hooks using specific permissions, leaving security guarantees outside the guidance's scope

Uniswap Labs launched Uniswap v4's Aggregator Hooks on October 22, 2026, across Ethereum mainnet, Base, and Robinhood Chain