Treasury loses approximately $1.381 million as Polkadot XCM vulnerability exploited

According to monitoring by the Polkadot forum, a post-mortem of the XCM incident published on the forum shows that between October 24 and 26, a vulnerability in the XCM executor on Polkadot Asset Hub was exploited. The attacker reduced the bookkeeping issuance of dotUSD without changing account balances, distorting the pricing of the DOT/dotUSD pool and creating arbitrage opportunities, causing an estimated loss of approximately $1.381 million in DOT value. The Polkadot Treasury was the sole liquidity provider for the pool, and no user funds were lost. The post-mortem noted that the vulnerability had been reported in June through the bug bounty program, and the relevant code had been fixed, but the fix was not deployed in time to the affected mainnet runtime version. On October 20, the reporter publicly mentioned the fix on the forum, which may have provided clues to the attacker.