Ekubo: An EVM Swap routing contract security incident occurred; Starknet was not affected

According to an official announcement published on X by AMM infrastructure Ekubo on May 6, a security incident occurred in Ekubo’s Swap routing contract on the EVM chain. Ekubo confirmed that neither liquidity providers (LPs) nor Starknet were affected by this incident. The team is investigating the scope of the incident and preparing a post-incident analysis report.

Scope of the Security Incident

According to Ekubo’s official announcement on May 6, this security incident only involves the Swap routing contract on the EVM chain. The following specific contract addresses were affected:

Ethereum: V2 and V3 routing contract addresses

Arbitrum: V3 routing contract address

Ekubo’s announcement confirmed that the assets of liquidity providers were not affected, and the contracts on Starknet were also not affected.

User Action Recommendations

According to Ekubo’s official announcement on May 6, Ekubo advises users to take the following actions:

First, immediately revoke all token approvals for the affected addresses, covering the Ethereum V2 and V3 contract addresses, as well as the Arbitrum V3 contract address.

Second, be cautious of any links claiming to be related to the Ekubo Protocol or this vulnerability.

Ekubo stated that the team is preparing a post-incident analysis report, and will further disclose the full details of the incident later.

FAQ

What is the scope of the Ekubo security incident? Will Starknet be impacted?

According to Ekubo’s official announcement on May 6, this security incident only involves the Swap routing contract on the EVM chain. The affected contracts include the V2 and V3 routing contract addresses on Ethereum, as well as the V3 routing contract address on Arbitrum. Liquidity providers (LPs) and Starknet were not affected.

How should users respond to this Ekubo security incident?

According to Ekubo’s official announcement on May 6, users should immediately revoke all token approvals for the affected addresses (Ethereum V2, V3, and Arbitrum V3 contract addresses), and be cautious of links claiming to be related to the Ekubo Protocol or this vulnerability.

What information will Ekubo disclose next?

According to Ekubo’s official announcement on May 6, the team is investigating the scope of the incident and preparing a post-incident analysis report. It will further disclose the full details of the incident later.