THORChain to Deploy Security Upgrade on October 23
The v3.21 upgrade will address a smart contract vulnerability that forced Rujira to pause its operations.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust the security of decentralized finance platforms that require manual service halts during exploits?
THORChain is scheduled to activate a critical v3.21 software upgrade on October 23 at block 28,366,100 to patch a vulnerability. The fix aims to resolve an exploit involving concentrated liquidity positions that previously forced Rujira to pause its App Layer.
Why it matters
The upgrade is a mandatory requirement for Rujira to unpause its platform and restore trading and lending services for its users. By addressing the FIN contract vulnerability, the protocol aims to prevent unauthorized movement of liquidity positions and secure the ecosystem.
The v3.21 upgrade utilizes a private binary to deploy security patches that address a transfer vulnerability at the THORChain Base Layer. The patch specifically targets a weakness in FIN contracts that allowed the unauthorized movement of liquidity positions.
The players
THORChain
THORChain is a decentralized cross-chain liquidity protocol that facilitates the exchange of digital assets across various blockchains.
Rujira
Rujira is a decentralized finance project that leverages THORChain smart contracts to provide trading and lending capabilities.
The details
The vulnerability allowed an attacker to misappropriate custom concentrated liquidity positions, although no user funds were lost in the incident. Rujira plans to institute a 24-hour collateral grace period to protect borrowers before resuming full liquidation processes.
Timeline
September 26: Rujira reported the exploit and paused its App Layer.
September 27: Rujira provided a public update regarding the patch development process.
October 10: Rujira issued a formal warning to users regarding upcoming position liquidations.
October 15: Rujira announced the formal plan to request the removal of the platform pause.
October 23: The v3.21 upgrade activation is projected for block 28,366,100.
The Tech Race
This patch highlights the ongoing arms race between decentralized protocols and attackers targeting smart contract vulnerabilities. By rapidly iterating through versions like v3.21, platforms attempt to solidify their security infrastructure against increasingly complex exploits.
Users with open positions on Rujira should be prepared for the resumption of liquidation services following the 24-hour grace period. The upgrade ensures that trading and lending can function safely without the risk of unauthorized liquidity position movement.
The takeaway
Protocol upgrades are essential maintenance in the fast-moving world of decentralized finance to combat sophisticated smart contract exploits. Users should monitor platform status updates closely during and after the upgrade to ensure their collateral and positions remain managed correctly.
What happens next
Following the activation of the v3.21 upgrade on October 23, Rujira expects to resume trading and lending services once the 24-hour collateral grace period for borrowers has concluded.
Further reading
For more information on how developers secure decentralized networks, visit Cybersecurity.
Live Poll
Do you trust the security of decentralized finance platforms that require manual service halts during exploits?
