Velar PerpDEX Incident – Official Technical Update Key points upfront - - This was not a smart contract hack. - All smart contracts are safe. - The issue affected only Velar PerpDEX liquidity pools, not Dex liquidity pools. - Traders are safe and unaffected. - LP funds were compromised. - No open user positions or traders balances were compromised. --- Additional Technical Clarification on the Velar PerpDEX Incident Velar PerpDEX uses the Pyth Oracle on Stacks, which operates on a model where a price update is submitted every time a transaction is initiated. Each submitted price is verified on-chain using a timestamp, and the oracle contract enforces that any new price must have a newer timestamp than the previously submitted price. There was no additional staleness validation beyond this timestamp check in our system. Under normal conditions, where multiple users are actively trading, this mechanism functions as intended because frequent transactions continuously refresh the oracle price. During the incident, user activity on the platform was extremely low. This created an edge case where a single actor was able to interact with the system in isolation. In this scenario, the exploiter was able to: - Receive two oracle prices with different, sequential timestamps. - Predict price movement due to the absence of other transactions refreshing the oracle. - Open a position using a known price. - Close the position using a second known price with a newer timestamp. - Capture a small, deterministic profit. This was not a single event, but a slow, repeated process, executed via small trades across multiple wallets, which made the activity blend into normal pool fluctuations. --- Actions taken - The exploit path has been fully identified. - Additional oracle safety checks are being added to prevent reuse of known prices, especially during low user activity periods. - More detailed analysis will be shared soon. --- Final note This was a design edge case under extremely low user activity conditions. We will be addressing it directly and transparently, and will continue to harden the system as Velar scales.

Hello everyone, kindly avoid trading on Velar perpdex for time being. Due to an oracle price feed issue, some user has started draining our Perpdex LP pools recently, thus we are withdrawing liquidity out of the perpdex pools temporarily. This issue is limited to perpdex only, Velar Dharma dex is working fine. We are coordinating with @Stacks as the foundation have put majority liquidity and they are withdrawing it temporarily as we speak till we resolve it. We have also found a solution and are working to resolve it asap.