Technology Insights
最新のテクノロジー動向とインサイトをお届けします。
On 2026-09-11, around 11 users of ether.fi Liquid (liquidETH) lost roughly 15.45 ETH in total, about USD 38,130. `AtomicQueue.solve()` applied no access control to the solver parameter supplied by the caller, so an attacker could craft an AtomicRequest that put already-approved victim addresses in the solver position and consume their remaining ERC-20 allowances via `transferFrom`. The amount is small, but a structurally identical case hit BNB Chain the same week, and the shared lesson is that approvals granted in the past become attack surface whenever a third-party contract fails to validate its address arguments.
On 2026-09-09 Osmosis disclosed that a flaw in Nomic's custom forwarding mechanism allowed nBTC to be double-spent, sending unbacked vouchers into Osmosis over IBC. Of allBTC's backing, 39.84 nBTC — roughly 36.03% — is invalid; a moderation subDAO froze inflows and outflows, and validators ran an emergency upgrade that locked 22.65 BTC at the attacker's address. Neither the Osmosis chain nor IBC was compromised; the defect sits on Nomic's side. Recovery is a two-step plan — seize the frozen coins, top up from the community pool — and both steps need a governance vote.
On 2026-09-06 at 15:53:10 UTC, at Liquid block 4,050,336, a flaw in how Elements caches range-proof verification results was exploited to create roughly 4,000 BTC worth of unbacked L-BTC. The forged L-BTC was then redeemed through the ordinary peg-out path, draining real bitcoin from the federation reserve; no private keys were compromised. Node operators must move to Elements v23.3.4, and any service holding L-BTC should start monitoring issuance against backing rather than watching the reserve balance alone.
On 2026-09-07, Cozy Finance, a DeFi protection protocol on Optimism, lost roughly USD 160,000. The attacker first acquired PTokens in the Aave v2 and Curve protection markets, then submitted a "YES" answer — asserting the covered event had occurred — to UMA's Optimistic Oracle, where it settled unchallenged. Two design gaps made the sequence work: the trigger never independently verified a real incident, and payout eligibility was not tied to a holder snapshot taken before the assertion was proposed.
On 2026-09-07 the Ethereum Foundation's Protocol cluster published a tier list grading every one of the 62 EIPs proposed for Hegotá, alongside a companion post setting out the priorities behind those grades. The change that matters is structural: what used to be per-team opinion posts is now one unified view drawn from 397 grades cast by roughly 60 people across nine teams, and each tier carries a delivery commitment — an S means the schedule bends before the scope does. A hard deadline of December 2029 for a quantum-resistant base layer is what shapes which proposals get pushed.
At All Core Developers Consensus #186 on 2026-09-03, epoch 351232 was agreed as the proposed Glamsterdam activation on Sepolia, with the corresponding time reported as 2026-10-06 13:53 UTC. Computed from Sepolia's beacon genesis, however, epoch 351232 falls on 2026-09-28 at 14:44:48 UTC, and 2026-10-06 13:53 UTC is not an epoch boundary at all. Glamsterdam has still not activated stably on any private devnet, and Devnet-11, launching 2026-09-14, is the next real datapoint.
Base has published plans to bring account abstraction into the protocol itself with EIP-8130 in its next network upgrade, Cobalt. Accounts register who may act for them and how signatures are validated in an onchain system contract, and the chain validates every transaction against that configuration — no alternate mempool, no bundlers, no EntryPoint. Base's published figures put USDC transfer gas at 46,000 against 125,000 under ERC-4337, a 63.2% reduction, with transaction byte size down 83.4%. September is the target, but no date is confirmed and the implementation is explicitly experimental and unaudited.
During September 2026, Ledger's Ethereum device app will drop support for `signEIP712HashedMessage`, the hashed (blind-signing) variant of EIP-712. That removes the last working path for `@ledgerhq/hw-app-eth`, and every LedgerJS package — `hw-app-*` and `hw-transport-*` — is deprecated from the same date. Applications that have not migrated to the Device Management Kit (DMK) by then will be unable to sign typed data on Ledger devices.
On 2026-08-31, Injective mainnet produced no blocks between 16:10:02 UTC and 19:52:14 UTC — three hours, forty-two minutes and twelve seconds — while roughly $4.9 million was extracted through binary-options markets. The attacker is reported to have created a large number of short-lived markets wired to an oracle they controlled, then drawn more than they deposited via the refund path the protocol falls back to when no valid settlement price exists. Injective describes the event as an upgrade rather than a halt; because the emergency release touches core modules, that framing is disputed, and a full post-mortem is still outstanding.
On 2026-08-30, Cronos validators stopped producing blocks in response to a price-manipulation attack on Tectonic, the chain's largest lending protocol, then restarted from a snapshot taken before the exploit. The attacker inflated the price of TONIC, a thinly traded governance token, roughly a hundredfold in about twenty minutes and borrowed against it. The rollback kept most assets in place, but the roughly $6 million that reached Ethereum before the halt did not come back. That asymmetry is the part that matters for anything connected across chains.
SIMD-0296 raises Solana's maximum serialized transaction size from 1,232 bytes to 4,096, and SIMD-0385 defines the v1 format that carries it. The feature gate activated on testnet at epoch 1025 on 2026-09-01, with mainnet scheduled for 2026-09-09. Senders are unaffected unless they opt in, but anything that reads blocks will fail an entire `getBlock` call — not just one transaction — if it has not set `maxSupportedTransactionVersion` and upgraded its SDK.
On 2026-08-28 Cosmos Labs published a post-mortem on GHSA-7g4w-cg88-2cq2, a balance-handling vulnerability in the shared cosmos/evm module. The flaw had been reported through its bug bounty programme on 25 April, but was assessed as posing no risk to funds on live networks and handled as a public patch with no security advisory. The first attack began roughly twenty hours after that patch shipped, and about $5.72 million (roughly ¥910 million at USD/JPY 159, 2026-09-02) was realised across six chains. The substantive issue is not the bug but the disclosure design for shared dependencies.
On 2026-08-28, Avici and Tria — two Solana-based card products sharing the same card-issuing partner, Rain — separately disclosed a vulnerability in Rain's Solana card contract. The exposure was confined to the contract holding balances after a card top-up, not to self-custodial wallets. Avici reported 1,685 users and $500,859; Tria followed on 3 September with 636 users and $431,945. Both pledged full refunds. It is a clean example of shared-component risk: neither company changed a line of its own code, and both became incident owners on the same day.
At the execution-layer All Core Developers call (ACDE) on 2026-08-27, the native account abstraction proposal EIP-8141 (Frame Transactions) was raised from Considered for Inclusion to Scheduled for Inclusion. The decision signals that Ethereum will ship account abstraction in Hegotá; it does not freeze the specification, or even the final EIP number. The rival proposal EIP-8130 is due to go live on Base in September, creating a period in which different account abstraction schemes coexist on L1 and L2.
On 2026-08-22, an attacker drained 2,985,651,403.40 TAC — 28.6% of supply — from the bonded staking pool of TAC, an EVM-compatible L1 connected to the TON ecosystem, in a single transaction. Block production stopped at 23:58:11 UTC with block 24,671,475. The root cause traces upstream to a mismatch between two balance records in Cosmos EVM: the EVM StateDB tracked only spendable tokens while the Cosmos SDK ledger also held locked vesting tokens that could be delegated, so delegating beyond the spendable amount caused an unchecked subtraction to wrap toward 2^256. The fix had been backported into releases on 19 August, three days before the attack.
On 2026-08-21 Solana reduced mainnet slot time for the first time since genesis, moving from 400 to 350 milliseconds. This is the first of four 50ms decrements defined by SIMD-0525; the per-block compute unit ceiling drops proportionally from 100M to 87.5M, and epoch length shortens from about 48 hours to about 42. Throughput does not increase, but every constant defined in blocks now means something different in wall-clock time — so the impact lands on applications more than on validator operations.
On 2026-08-20, a compromised maintainer account on crates.io was used to publish malicious releases of arrayref, internment and append-only-vec. Each added a dependency on proc-macro1, an attacker-controlled typosquat whose build script fetched and executed a remote payload at compile time. Because the code lived in a build script, nothing had to be called for it to fire — building was enough. Teams shipping Rust tooling around Solana or Ethereum should assess this on whether they built during the exposure window, not on the fact that the releases are now gone.
At ACDC #185 on 2026-08-20, consensus-layer client teams proposed activating Glamsterdam on Sepolia at epoch 351232 / slot 11239424, 2026-09-28 14:44:48 UTC. No objections were raised, but the same line in the minutes records that the decision was deferred to the next ACDC, so the date is not settled. Hoodi follows on 26 October, and mainnet remains a Q4 2026 target with no date at all. Circulating the proposed stage internally as if it were confirmed is how schedule credibility gets spent.
The Ethereum Foundation announced the Glamsterdam-specific public testnet Platåberget on 2026-08-17 and forked it to Glamsterdam rules on 2026-08-20. Alongside ePBS (EIP-7732) and Block-Level Access Lists (EIP-7928), EIP-8037 pulls state-creation cost out of ordinary execution gas, which means any code that treats intrinsic gas as a constant will stop working. Mainnet is targeted for Q4 2026 with no date fixed, but the real deadline for tooling is the Sepolia fork, which arrives sooner.
On 2026-08-19 the Ethereum client firm Nethermind announced it had migrated away from LayerZero DVN operations and joined the Chainlink Network as a node operator and strategic technology provider, helping run CCIP and Data Feeds. It identified no technical flaw at LayerZero and has not published the "extensive review" behind the decision. This is reportedly the first public case of a DVN operator leaving of its own accord. The substance is that in a configurable-security model, the composition of the verifier set can change without any of it being visible to downstream contracts.
On 2026-08-18 a single MsgDeposit transaction carrying 23 messages was submitted to MAYAChain mainnet, chaining six defects across theft detection, slash compensation, pool accounting and outbound handling. Compensation logic fired in error and credited roughly 49.45 million CACAO to a thin pool without reference to the reserve's actual balance; the transfer failed, but the inflated balance alone was persisted. The attacker realised about $1.65 million (roughly ¥260 million at USD/JPY 159, 2026-09-02). The substance is not a single bug but a missing rollback on the failure path.
On 2026-08-17, alongside the launch of the Platåberget testnet, Ethereum Foundation's Protocol DevOps team stated plainly that Glamsterdam carries breaking changes for application developers. At the centre is EIP-8037, which introduces a separate state gas dimension: operations that create new state are metered at a fixed cost per state byte and charged at runtime. As a result a plain ETH transfer is no longer always 21,000 gas, and any wallet, indexer or gas estimator that hardcodes a maximum gas limit will stop working unless updated.
On 2026-08-13, Ethereum Foundation researcher Justin Drake announced that Ethereum is abandoning Poseidon for L1 and pivoting to conventional hash functions such as SHA or BLAKE. Poseidon arrived in 2019 as a "ZK-friendly" hash designed to be cheap to evaluate inside SNARK circuits, and the EF has spent eight years and an eight-figure budget on the surrounding research. The pivot follows progress on leanVM, which works over binary fields where conventional hashes are the cheaper option. Teams whose ZK designs assume Poseidon should revisit the reasoning behind that choice.
The Agave v4.3 release schedule maintained by Anza lists 2026-09-28 as the date mainnet feature activation begins. v4.3 carries Alpenglow, which replaces Tower BFT and Proof of History with Votor and Rotor; activation on testnet and devnet completed on 19 and 24 August respectively. The operationally significant detail is not the eventual 150ms finality but the handover: Firedancer is not implementing the live migration window, so operators are expected to run Agave for that period and switch back afterwards.
