Huma Finance (HUMA)

Today, we have been working closely with @blockaid_ to thoroughly investigate the vulnerability attack on the @humafinance v1 protocol that occurred last night. Blockaid's incident analysis report is very detailed (link in the first reply), and we will not repeat it here.

Below is the TL;DR of the incident and the lessons we learned about system architecture and operations. 👇

TL;DR
Attack incident: The attacker discovered a vulnerability in the smart contract and stole about $101,000 of protocol fee & pool owner fee from three old v1 pools on Polygon.

User funds: User funds were not affected at all.

Risk isolation: The issue was with the Huma EVM v1 contract and is completely unrelated to PST and all Huma smart contracts on Solana.

Solana contract: The program on Solana uses a completely redesigned architecture and does not contain the compromised logic.

Current status: All v1 pools have been paused.

Key lessons: On the surface this appears to be a smart‑contract bug in the v1 version launched early 2023, but it highlights several issues in protocol design and operations.

1. Do not mix important state transitions into functions with complex logic. _updateDueInfo() and _getDueInfo() calculate due amounts and various fees and are the most complex parts of the v1 contract. Embedding borrower state transitions into these complex functions is not a wise choice. We later became dissatisfied with this design and abandoned it in the Huma v2 contract, opting for a simpler architecture.

2. Rigorously remove unnecessary features. requestCredit() was introduced to support future extensions but was never used in practice. Non‑critical functions receive less testing and security review, creating unnecessary attack surface. We discussed removing it before release but kept it, thinking it harmless. If a function is not required, it should not be placed in the contract.

3. Actively shut down pools that are no longer used. Keeping obsolete pools creates unnecessary risk. Today, both developers and attackers are actively using AI, and some old contracts have not undergone AI audit, potentially exposing more weak points. The work to shut down v1 pools had already begun but was not prioritized highest; we should be more decisive on this.

This is a painful lesson. We must learn from it and not waste the high tuition fee. We share our immediate reflections and lessons here, hoping to help other ecosystem builders, especially projects with legacy contracts, to better protect against hackers. DeFi

Incorrect HUMA unlock data was identified across CoinMarketCap, Coingecko, and Binance.

CoinMarketCap now reflects correct figures following direct coordination with the team. Coingecko and Binance updates are in progress.

Reminder: As outlined in the HUMA: Built to Last article, the first Investor & Team unlock has been postponed from May 26 to Nov. 26, 2026.

$HUMA @humafinance Levels of interest 👀

Huma at interesting level if we tap that Monthly open and lose POC will interested in a short trade. ✍️

Volume profile of that previous range is not ideal, not a AAA+ setup so waiting for the reaction. https://t.co/W8CcX3hbr1