permi

Aleo released the privacy stablecoin white paper "Stablecoin Privacy," stating that the privacy layer is the key infrastructure missing for blockchain payment rails to be adopted by mainstream institutions. Aleo indicated that as the GENIUS Act provides opportunities for the widespread adoption of stablecoins, the issue of permanently public transaction information on public blockchains may still hinder institutions from using stablecoins in scenarios such as payroll, fund management, and vendor payments.Aleo claims that existing solutions do not adequately meet the needs of institutions in terms of privacy protection and risk management. The white paper proposes a permissionless private stablecoin architecture based on Aleo, which introduces programmable risk mitigation mechanisms while protecting transaction privacy through zero-knowledge technology and programmable smart contracts, allowing institutions to conduct private transactions without sacrificing compliance and risk control.It is reported that the team members behind this white paper have long been dedicated to research at the intersection of cryptography, policy, and financial systems. Aleo's Global Policy Director Yaya J. Fanusie, member of the Crypto Innovation Council and former Global Financial Crimes Compliance Officer at Coinbase Valerie-Leila Jaber, and cryptographer and Johns Hopkins University Computer Science Professor Matthew Green possess rare practical experience in private payments, financial regulation, and zero-knowledge cryptography.

According to GoPlus warning, a user lost approximately $316,000 worth of USDC to a phishing attack due to signing a malicious Permit2 transaction.

Anatoly Yakovenko (toly), co-founder of Solana Labs, responded to discussions about the decentralization level of Hyperliquid, stating that he has raised the same criticism for all L2s: the key to determining whether a system is permissionless lies in whether users can participate in any part of the protocol stack using their own resources without approval from a trusted third party.If they cannot, it is not permissionless. Toly stated that no matter what users do, they cannot run the Base sequencer or the Hyperliquid sequencer, so this is the same issue he criticized with L2s.

According to CCTV News, the chairman of the Iranian Parliament's Civil Affairs Committee stated that under the Parliament's plan for managing the Strait of Hormuz, all traffic in the Strait of Hormuz must obtain permission from Iran, and any goods belonging to Israel are not allowed to pass under any circumstances. Hostile countries engaged in conflict with Iran are not permitted to pass through the Strait of Hormuz until compensation for damages is made.

The Layer 1 blockchain Tempo, developed jointly by Stripe and Paradigm, has launched a privacy feature called Zones. This is a solution for running permissioned parallel blockchains, specifically designed for enterprise-level use cases that require higher confidentiality, such as payroll, fund management, and payment settlement.It is reported that Zones, as a parallel blockchain connected to the Tempo mainnet, provides a private execution environment where internal transactions remain confidential, but assets and funds are fully interoperable with Tempo L1, other Zones, deposit channels, and liquidity pools. Each Zone is managed by trusted entities such as financial institutions or infrastructure providers, allowing operators to view all activities within their environment and implement access controls, but they do not control the underlying assets.

The UK's Financial Conduct Authority (FCA) has released the final draft of the crypto asset framework. This new regulation is set to bring most crypto activities under the regulation of the Financial Services and Markets Act by October 25, 2027.According to the proposal, any institution that holds customer crypto assets for more than 24 hours or has the ability to revoke customer permissions will be considered a regulated custodian and must hold a full safeguarding license. Validators and node operators that provide value-added features such as yield or reward reinvestment will lose their technical exemptions. In addition, stablecoin issuers within the UK must control the entire lifecycle from issuance to redemption. Relevant institutions must submit authorization applications between September 30, 2026, and February 28, 2027.

According to the official announcement, in order to meet the market demand for trading in the AI-related sector of US stocks, Bitget stock contracts have now launched six popular underlying assets: AMD, AMAT, SNDK, STX, LITE, and FLY, covering areas such as chips, semiconductor equipment, and storage. The aforementioned contracts support a maximum leverage of 20 times. For more details, please refer to the Bitget official platform.

According to disclosures from the GoPlus Chinese community, a user lost approximately $316,000 in USDC from their wallet due to signing a malicious Permit2 transaction, which was exploited by a phishing attacker.GoPlus advises users to adhere to the "four no" principles for phishing prevention: do not click on unfamiliar links, do not install unknown software, do not sign transactions with unclear content, and do not transfer funds to unverified addresses. They also recommend installing the GoPlus security plugin to intercept phishing risks in real-time.

Monad co-founder Keone Hon released a protocol security self-inspection checklist on the X platform, focusing on core issues such as management permissions, fund security, and multi-signature mechanism design, which mainly includes ten points:Clearly identify which admin functions may lead to fund loss;Ensure that relevant operations are time-locked;Establish a real-time monitoring mechanism;Provide timely alerts when admin functions are called;Review all privileged accounts and try to use a multi-signature (k-of-n) structure;Clarify signature threshold parameters;Multi-signature signers should use independent cold devices solely for signing operations and follow best practices (such as independently verifying transaction hashes);Set rate limits on withdrawals and avoid control by the same multi-signature;Ensure employee devices have malware detection and management capabilities;Predefine extreme scenarios where multi-signature signers are compromised, reverse engineer potential attack paths from the attacker's perspective, and optimize system design accordingly to increase attack costs and complexity.

According to market news, Saudi Arabia announced a 30-day permit exemption for vessels in the Persian Gulf.

According to GoPlus security monitoring, an address starting with 0x9709 signed malicious Permit and Approve transactions, resulting in approximately $200,000 worth of USDC and wmtUSDT being stolen by phishing attackers.GoPlus states that users should carefully verify transaction details and contract addresses when signing any on-chain authorizations (Approve) or offline signatures (Permit) to avoid signing unknown malicious requests and prevent asset theft.

According to GoPlus monitoring, about 8 hours ago, a user lost $1.76 million in USDC to a phishing attack after signing a malicious Permit transaction.

Curve Finance posted on platform X that PancakeSwap seems to have used Curve's code without permission, violating its open-source license agreement. Curve Finance stated that such actions are not only illegal but have historically proven to be unwise in other respects.Curve Finance also pointed out that if PancakeSwap wishes to legally use its Stableswap feature and draw on its security practices to ensure user fund safety, they can still reach out through licensing or collaboration.

Lido tweeted that the V3 Phase 3 has been launched. Now, all stVaults can mint stETH without permission, and the minting limits for identified node operators have also been increased. The initial deployment work for Lido V3 has now been fully completed.

The heads of the People's Bank of China and the China Securities Regulatory Commission stated that the background for the release of the "Notice on Further Preventing and Dealing with Risks Related to Virtual Currencies" (hereinafter referred to as the "Notice") is: based on summarizing previous work experiences and in conjunction with the new risk situation, the original document has been revised to form the "Notice."In addition, this notice continues the policy stance of recent years, reiterating that virtual currencies do not have the same legal status as legal tender, and that conducting virtual currency-related business activities within the country is considered illegal financial activity. Foreign entities and individuals are not allowed to illegally provide virtual currency-related services to domestic entities in any form.In response to the rapid development of real-world asset tokenization in recent years, the "Notice" emphasizes that conducting real-world asset tokenization activities within the country, as well as providing related intermediary and information technology services, which may involve illegal issuance of token vouchers, unauthorized public issuance of securities, illegal operation of securities and futures businesses, and illegal fundraising, should be prohibited; except for related business activities conducted based on specific financial infrastructure with the approval of the competent business authorities in accordance with laws and regulations. Foreign entities and individuals are not allowed to illegally provide real-world asset tokenization-related services to domestic entities in any form.

According to official updates, SUN.io has announced the completion of a new upgrade to its smart routing system, officially introducing the Universal Router and Permit2 protocols. After the upgrade, users can complete optimal path exchanges across multiple liquidity pools such as SunSwap V1/V2/V3, Curve, PSM, and HTX-SUN in a single transaction. At the same time, through Permit2's one-time high-limit authorization and signature validity period and limit mechanism, it significantly reduces the energy consumption costs of repeated authorizations and enhances security.The official Tron mainnet Permit2 and Universal Router contract addresses have been disclosed, reminding users to interact with the contract addresses disclosed by the official source to securely enable a more efficient trading experience.

According to Caixin, starting from January 1, the balance of digital RMB wallets will begin to accrue interest. It is reported that its smart contracts are different from the "on-chain" smart contracts known for being built on blockchain due to Ethereum. Senior digital RMB experts point out that digital RMB is not built on blockchain, but rather based on a newly designed account system, where the central bank and commercial banks jointly maintain "the same ledger." By loading "smart contracts that do not affect the monetary function," digital RMB achieves programmability, supporting features such as targeted payments and automatic execution.In addition, Caixin also disclosed that only real-name authenticated digital RMB wallets can accrue interest, meaning that Type I, II, and III wallets can earn interest, while Type IV non-real-name wallets do not earn interest (as the ownership of Type IV wallets cannot be confirmed). After January 1, mobile banking apps from participating operating banks, as well as payment platforms like WeChat and Alipay, will gradually gain the authority to open digital RMB wallets.