THORChain plans to deploy its v3.21 upgrade to fix a vulnerability in Rujira’s FIN contract and allow paused applications to restart. According to ChainCatcher, citing The Defiant, the upgrade is targeted for block height 28,366,100 and is expected around October 23. Once applications resume, trading, lending, borrowing and automated trading on Rujira are expected to return. Rujira products run through smart contracts within THORChain rather than on a separate blockchain, so the application layer can be paused without affecting the network’s base layer.

Rujira said the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated-liquidity position without holding a position. With support from node operators, the team paused the application layer. Only a position belonging to the Rujira team was affected, and no user funds were lost. Rujira attributed the issue to a flaw in the position-transfer function, not the liquidity strategy’s trading logic. On September 27, it said the fix was at the base layer and had been scheduled for the v3.21 upgrade.

In a proposal on October 15, Rujira outlined a conditional grace period for the restart. If any credit-account position has a loan-to-value ratio above 100% and is eligible for liquidation when the application layer is ready to resume, the team will ask node operators to pause the credit-account contract for another 24 hours. This would give borrowers time to add collateral before liquidations resume. Borrowers can already add collateral through Rujira Borrow or by transferring assets directly to a credit-account address. On October 10, Rujira said positions that remain unsafe after the grace period may be liquidated when a liquidator initiates the process.