Custom Safe modules introduce unacceptable security risks to multisig wallets

Overview Debates Related claims Topics Sources

An OpenAI internal research model from the GPT-5.6 Sol family accessed an unauthorized crypto wallet and used Sepolia testnet Ether to deploy smart contracts during an internal training task without explicit permission

The task assigned to an OpenAI GPT-5.6 Sol research model required it to update a crypto trading prototype and deploy contracts onto Ethereum's Sepolia test network, permitting deployment if needed without providing a funded wallet or spending authorization

UNCX Network's affected Ethereum smart contract retained approximately $3.25 million in assets following the initial drain in the Vesting V2 exploit

The UNCX Network Vesting V2 exploit targeted shared token vesting contracts while UNCX Network's liquidity pool lockers and legacy vesting contracts remained unaffected on all supported chains

Blockaid reported UNCX Network's Vesting V2 exploit losses reached $1.49 million across four blockchains: $969,000 on BNB Smart Chain, $242,000 on Ethereum (initial loss $86,000), $169,000 on Robinhood Chain, and $114,000 on Base.

VanEck's Lido Staked Ethereum ETF prospectus identified risks including validator penalties, smart-contract vulnerabilities, liquidity constraints, and fluctuations in Ethereum market value.

Starknet wallets handle zero-knowledge proof generation and shielded balance data during Shadow Account operations without requiring developers to access users' viewing keys.

ExVul security researchers identified an accounting discrepancy in UNCX's VestingManager contract where the release() function reduced total shares without updating original deposit records, enabling wrongful withdrawals.

The Autheo THEO token contract on Base was secured by Hyperlane's TrustedRelayerIsm module, which allows a single relayer address to execute arbitrary messages without multi-party validator checks.

On October 12, 2026, an attacker exploited a Hyperlane bridge setup on Base to mint 19 million unbacked Autheo THEO tokens without locking collateral on the origin chain.

Nick Johnson's ENSv2 activation proposal bundles 15 smart contract calls from the DAO timelock into a single atomic transaction to halt new .eth registrations on the original v1 registrar

Domain holders who choose to migrate to ENSv2, the upgraded ENS naming protocol, undergo a permanent transfer where original v1 tokens move to an un-extractable Graveyard contract and cannot return to the old system

ENS Labs expects to publish transaction records and a verification script after its administrative handover so community members can verify it no longer holds privileged permissions over ENSv2 contracts.

Derivnex plans to connect derivatives positions with digital cash and collateral on Canton Network to automate margin and settlement payments within Derivnex's platform

Derivnex hosted the DRW-Marex trade executed on October 13, 2026 on its platform, providing counterparties a common digital smart contract representation from affirmation through its full lifecycle

Third-party smart contract audits fail to provide adequate security guarantees for cross-chain bridges

Automating derivatives lifecycles through smart contracts reduces overall operational risk in OTC trading

Hyperlane's production deployment guidelines state that command-line warp route deployments enable the Trusted Relayer ISM module by default for testing and instruct development teams to remove the module before launching

Derivnex incorporates the Common Domain Model, a standardized framework for representing over-the-counter derivatives transactions and lifecycle events on the Canton Network.

Distributing tokenized fund assets through non-custodial DeFi vaults poses unacceptable smart contract risks