Yesterday, we learned that the Panther Base deployment was attacked.

The Base deployment was not yet in production. No user funds were compromised. The attacker managed to steal approximately 5.12M ZKP and 0.12 ETH by submitting a Reality.eth proposal which was not challenged within the applicable challenge and cooldown period.

The dev team has restored the affected proxy implementations. The attack was possible because protections designed to disable the Reality.eth module when there is no active governance proposal had not been enabled on the Base deployment.

Panther DAO has taken measures to address the Reality.eth configuration on Base. The relevant teams are also confirming that the equivalent protections are properly enabled across Panther’s other deployments.

A fuller incident report will follow once the review of the incident is complete.