Doing this on my account as it allows longer posts, but this is @Compxlabs related. Unfortunately our legacy token stream contracts were exploited today, 9th October. These contracts, from 2023 are no longer used, as they were replaced with the more modern Waypoint contracts for payments - any payments set up via the current contracts are not affected. --- A stream is supposed to pay one recipient on a schedule. The contract holds the tokens and releases them over time. An account that was not the sender or the recipient replaced the code on those contracts, then withdrew what was still inside. 44,078,064.233629 COMPX was drained. The first two we found were 2,241,758 COMPX from app 2460984089 and 2,184,066 COMPX from app 2461112995. Each of those also lost about 0.2 ALGO. The non-cancellable contract runs its withdraw logic on every application call, and a successful withdraw approves that call. Replacing the program is one of those calls, so the attacker’s update was accepted. They put a timestamp in the transaction that made the vesting math owe the recipient nothing, so the contract paid 0 COMPX and still approved the update. The new program then ignored the schedule and sent the remaining balance to the caller. Cancellable streams do check the call type. 599 streams are cancellable and are not affected. We have upgraded and fixed 187 non-cancellable streams. A claim still pays the recipient on the original schedule. A further change to the contract can only come from our admin account. 469 streams could not be upgraded because the receiver is not opted into the asset anymore. The contract cannot pay that account, or accept this update, until they opt in again. We will pay the taken COMPX back directly to affected users over the coming week with the aim to have all affected users' funds repaid by Friday 16th October.

We already did! Pqattest.com

As you know I love some x402 agentic payments. @LitecoinVM doesn't have a facilitator for LiteForge testnet so.... I made one! And made a little demo to try it out. Thanks for the tip @SirAlbert2A It's called Relay-14, and it's a part of the @Compxlabs As always, you can just do things!

❗️Introducing: PQ Attest Post-quantum attestation for any transaction. PQ Attest writes a transaction fingerprint , from any supported chain, onto Algorand’s quantum-secure ledger and returns a proof you can verify independently. Today that means @base and @Algorand: pay in USDC on either network to attest a @base transaction onto Algorand's future proof ledger. Built for agents (x402) and for teams who need a durable, post-quantum record they can independently verify. More supported chains coming soon. Learn more and try it yourself via the links to follow 👇