HypurrFi discloses an "Rounding Error" vulnerability in the early version of Aave V3, and has suspended new lending in the XAUT0 and UBTC markets.

CryptoWorld.com, March 6 — HyperEVM’s native non-custodial lending protocol HypurrFi announced on X that versions of Aave V3 before 3.5 contain a “rounding error” vulnerability. Under certain conditions, attackers can repeatedly perform supply/withdraw and borrow/repay cycles to extract underlying tokens. The affected markets are XAUT0 and UBTC within HypurrFi Pooled. Currently, user funds are not at risk. To ensure safety, related markets have paused new supply and borrowing operations. Withdrawal and repayment functions remain operational, and other markets are functioning normally. HypurrFi added that the issue was quickly detected on-chain through internal monitoring systems, and affected markets have been frozen. They are collaborating with other Aave deployers and security researchers to address the problem and have invited other Aave fork projects to contact them for more security information.