CVE-2026-62162

A flaw was found in Hydra. A remote attacker can intercept and steal committed funds by observing pending deposit transactions on the network. Because the deposit verification logic fails to properly constrain transaction outputs or verify protocol state, an attacker can submit a transaction...

Sanction Bypass Through Depositing to Authorized Borrower's Market

Lines of code Vulnerability details Impact Wildcat protocol provides lending with lender backed collateral considered as reserves and the ratio must be upheld by the borrower. The protocol team has taken certain steps to prevent interaction with sanctioned users. However, sanction status is only...

sendFundsToUser() does not verify that the user has deposited anything

Lines of code Vulnerability details Impact Users can request arbitrary amounts when requesting funds from the executor, because the deposit hash is not checked against actual deposits. The user can be the executor him/herself if they wish to rug-pull directly. Proof of Concept function...