THORChain plans to execute the v3.21 upgrade on October 23, fixing vulnerabilities to promote the restart of Rujira

THORChain announced that its v3.21 version upgrade will fix the FIN contract vulnerability on Rujira and allow the previously paused application layer to restart. The network has set the upgrade target at block height 28,366,100, with an expected time around October 23. After the restart, trading, lending, borrowing, and automated trading on Rujira will resume. Rujira's products operate through smart contracts within THORChain, rather than on an independent blockchain, and the application layer pause can stop these contracts without affecting the underlying layer of THORChain.

According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a position. The team paused the application layer with the support of node operators, and only one position from the Rujira team itself was affected, with no loss of user funds. Rujira attributed the vulnerability to a flaw in the position transfer function, rather than the trading logic of the liquidity strategy. On September 27, Rujira stated that the fix is located in the underlying layer and has been scheduled for the v3.21 upgrade.

Regarding the restart window, Rujira proposed a conditional grace period in its plan on October 15: if the application layer is ready to resume, any credit account position with a loan-to-value ratio above 100% and meeting liquidation conditions will request node operators to pause the credit account contract for another 24 hours, allowing borrowers to supplement collateral before liquidation resumes. Borrowers can supplement collateral through Rujira Borrow or by directly transferring assets to the credit account address. Rujira indicated on October 10 that positions still deemed unsafe after the grace period could be liquidated when the liquidator triggers the process.