Abstract responds to security incident: isolated vulnerability in third-party application Cardex causes loss of approximately $400,000

Odaily Planet Daily News Abstract responded to the security incident on X: "This morning, the Abstract security team detected a vulnerability originating from the application Cardex in The Portal. This is not a vulnerability in Abstract Global Wallet (AGW) or the Abstract network itself, but an isolated security failure of a third-party application (Cardex). Thanks to our engineering team, security researchers, Seal 911 and the Cardex team for taking quick action to eliminate the vulnerability and prevent further unauthorized access to user funds. The vulnerability involved a loss of tokens worth approximately $400,000. Cause of vulnerability The Cardex team completed the initial review and was approved to be listed on the portal. In the process, the Cardex team inadvertently exposed the private key to the session signer on the front end of their website, which was beyond the scope of the review and was also a practice we warned about. This allows attackers to initiate transactions to the Cardex contract for any wallet that has approved the session key. Abstract Security Standards Before adding any application to our portal, Abstract We follow a rigorous security process throughout our lifecycle. This includes: one-on-one onboarding with each team, collaboration on security best practices, and mandatory extensive security audits. We will continue to regularly consult with builders and security experts to improve our processes and set industry standards for security and user protection. User Action Required To prevent potential attack vectors, we strongly recommend that users regularly revoke approvals and permissions for applications and tokens in their Abstract wallets via Revoke. ”