PANews reported on December 14 that Aevo (formerly Ribbon Finance) tweeted that due to a vulnerability in a smart contract update, the old version of Ribbon DOV vault was attacked, resulting in a loss of approximately $2.7 million.

The team stated that all Ribbon vaults have ceased operation and will be immediately deactivated. Users must complete the contract upgrade and withdraw funds themselves through the standard process. The contract upgrade will be rolled out next week (to be announced later). Aevo disclosed that the vulnerability resulted in a loss of approximately 32% of the vaults, but the team recommends that users withdraw only 19% of the value of their positions at the time of the attack. The claim period is from December 12th to June 12th. After June 12th, the DAO will liquidate all remaining assets and distribute them to users who withdrew funds earlier.