Due to missing Dest parachain check
on polkadot and an asynchronous bug in DAPP, Parallel Heiko chain's user lost 63KSM. The detailed information has been put inside: ISSUE 5332.
Parallel Finance paid this loss to the user in Extrinsic 12280950-4 first and then fixed ParaId fetching bug inside the DAPP.
The issue happened while reading ParaId asynchronously using useApiCall
, there is no await
so there is 0.0001% chance that user submitted xcmPallet.reserveTransferAssets with undefined
ParaId, which is then serialized to null
and converted to 0
finally. This issue has been resolved quickly and deployed to Heiko DAPP, but it'll be good if polkadot can check if parachain exists before sending.
Then for getting this 63KSM back, Parallel Finance asked the user to sign the following message:
I confirm the receipt of 63 ksm transfer from Parallel Finance
User signed and gave the signature which you can verify on Kusama like THIS
0x44f7fb444c5b2fe146b17963a7d2307b05da0c0308cfc1d540614a74a675056c7897c4ee89945038d2dfc99bdaceba9c1f3ff90fa300f59a5387a3fdc18d778a
Parallel Heiko chain users lost 63KSM due to a missing "Dest parachain check" on Polkadot and an asynchronous bug in DAPP. The issue was documented in ISSUE 5332. Parallel Finance compensated the user and fixed the ParaId fetching bug in the DAPP. The problem occurred when reading ParaId asynchronously without using "await," causing a 0.0001% chance of submitting xcmPallet.reserveTransferAssets with an undefined ParaId. The issue was resolved and deployed to Heiko DAPP. Parallel Finance requested the user to sign a message confirming the receipt of 63 KSM transfer, and the signature was verified on Kusama.