HypurrFi disclosed a "rounding error" vulnerability and has suspended new lending in the XAUT0 and UBTC markets.

HyperEVM's native decentralized lending protocol, HypurrFi, announced on the X platform that a "rounding error" vulnerability exists in versions of Aave prior to V3 3.5. Under certain conditions, attackers could repeatedly execute supply/withdrawal and lending/repayment cycles to extract underlying tokens. The affected markets are XAUT0 and UBTC in HypurrFi Pooled. Currently, user funds are not at risk. To ensure security, new supply and lending operations in the affected markets have been suspended. Withdrawal and repayment functions remain operational, and other markets are running normally. HypurrFi added that it quickly detected the issue on-chain through its internal monitoring system and promptly froze the affected markets. It is also collaborating with other Aave deployers and security researchers to address the issue and has invited other Aave forks to contact them for more security information.