March to Mainnet Report 19/06 🏃 This week, core contributors have focused on security infrastructure, performance, and the final stages of Powfi contract review. We continue to work hard to get the bridge relaunched as soon as possible. As it stands, the internal review of the updated bridge code is complete, and is being handed over to a third-party auditing firm for review. Here is what has been worked on over the past week: <Frontend> ✅ Work is underway on a real-time security monitoring dashboard for the Alephium TokenBridge, covering USDT, USDC, WETH, and WBTC. ✅ This dashboard will provide ongoing visibility into the health and integrity of bridged assets, forming part of a broader commitment to transparent, proactive security monitoring across the protocol. ✅ The team has been running AI-assisted security audits across Alephium applications as a way to improve development workflow and complement traditional audit processes. ✅ An inconsistency in how the ALPH price was displayed across wallet interfaces has been identified and resolved, improving the accuracy of the information available to users (thank you to the community members that spotted it). ✅ Ongoing work to reduce the JavaScript bundle size across Alephium's web applications. ✅ Continued maintenance and cleanup of the frontend monorepo, improving code organisation and laying the groundwork for more efficient development going forward. <Backend> 🖥️ Continued progress on backend dependency management and database work, ensuring the infrastructure underpinning Alephium's core services remains stable and up to date. 💥 The team has completed a final round of review and fixes for the Powfi smart contracts. 🔢 The $ALPH pricing issue referenced in the frontend update has also been resolved on the explorer backend, ensuring consistency across all touchpoints. The focus remains on quality, security, and readiness. More updates to follow.

🧵How the Attacker's wALPH Was Burned “As part of the bridge incident remediation, the bridge guardians, with support from our security partners, executed an authorized recovery procedure to invalidate the unbacked wrapped ALPH held in the attacker's wallet.” The Bridge Guardians coordinated through the bridge’s multi-signature governance mechanism to temporarily upgrade the bridge’s wrapped asset contract implementation. This temporary implementation introduced functionality that allowed the attacker-controlled unbacked wALPH to be permanently burned. Immediately after execution of the burn, the contract was reverted to its original implementation. This action required approval from the full Guardian set, which is why the process took several days to organize and execute. Note that the guardians are separate and independent from each other. Alephium’s bridge wrapped asset contracts, like those used by many cross-chain bridge systems, are deployed behind upgradeable proxy contracts. This architecture allows contract implementations to be modified through Guardian-approved governance actions when required. It is important to note that the burn capability used in this remediation did not exist in the bridge’s normal operating implementation. It was introduced through a temporary governance-approved upgrade specifically to remediate the unbacked supply created by the exploit and was rolled back once the action was completed. This approach has precedent in previous DeFi security incidents. Following the pxETH exploit involving Yearn Finance, unbacked tokens were invalidated by the token issuer directly from the attacker's wallet. After the Echo Protocol incident, attacker-controlled eBTC was burned once administrative control had been recovered. The tokens burned in our case were exclusively the unbacked wALPH that remained in the attacker’s wallet at the time of the action. Any wALPH that had already left the attacker’s wallet prior to the burn was not affected. The recovery action was intentionally limited to assets that remained under the attacker’s direct control and did not affect third-party holders who acquired wALPH through ordinary market activity without involvement in the exploit. The action had no effect on assets held by legitimate users and did not affect any assets on the Alephium Layer 1 blockchain. The bridge itself remains disabled while remediation, review, and security assessment work continue.