Monday’s desk was DeFi wind-downs, a staking-oracle gas cap, and a Core DAO pause Coinbase closed overnight. On the site CoinGecko snapshot fetched at 00:18 UTC on September 7, 2026, Bitcoin was $80,305, up 0.5% over 24 hours. Ether was $2,514.17, up 1.3%. Solana was $106.43, up 3.0%. Global market cap sat near $2.72 trillion, bitcoin dominance about 59.2%, and 24-hour volume about $69.9 billion.
Gauntlet moved to wind down Compound’s quiet Ethereum wstETH Comet. Sky paid a $100,000 Critical bounty for a vote-tally bug. Lido capped VEBO exits at 500 per report, and GitHub rewrote EIP-8141’s MAX_VERIFY_GAS as a shared mempool floor. Coinbase restored Core DAO sends after a pause that started August 30.
Gauntlet starts winding down Compound's quiet Ethereum wstETH Comet
Gauntlet asked Compound governance on September 2, 2026 to begin deprecating the Ethereum wstETH Comet at 0x3d0bb1ccab520a66e607822fc55bc921738fafe3. The plan zeros the supply-side interest curve so 100% of borrower interest goes to protocol reserves, and sets every collateral supply cap to 0 so no new collateral can be posted, while borrow rates, collateral factors, liquidations, and existing positions stay in place. Gauntlet's snapshot through September 2 shows 280.23 wstETH supplied ($836,754) against 24.16 wstETH borrowed ($72,146), or 8.62% utilisation, with an on-chain vote slated in three to four weeks so large suppliers can leave first.
Sky pays a $100,000 Critical bounty for a vote-tally amplification bug
Sky published a post-mortem on September 3, 2026 for Immunefi report #82775 against the Sky Governance Portal at vote.sky.money. The polling contract emitted a raw optionId that the portal decoded byte by byte, so a single-choice voter could repeat the same option in one value and have their weight counted once per byte, with no user funds at risk. Skybase reproduced the whitehat's fork proof and on July 21, 2026 shipped parseRawOptionId deduplication plus a fetchPollTally guard that discards single-choice ballots with more than one distinct option, then authorized the Critical-tier payout of $100,000. A historical scan of Arbitrum votes for malformed option_id_raw values is still planned.
Ethresear.ch asks how to verify an ERC, not just one contract
On September 6, 2026, jay-oraclizer argued on Ethresear.ch that an ABI can make two ERC implementations callable without proving they agree on success, failure, or the state changes a call should produce. The post uses a restricted security token where FREEZE then SEIZE finishes in SEIZED, while the reverse order rejects the seize and leaves the token FROZEN, a gap that still sits in families such as ERC-1400, ERC-1644, and ERC-7943. The author points to ERC-TRUST, a public pre-ERC candidate whose machine-readable kernel generates interfaces and conformance vectors, and calls the larger goal whole-standard assurance rather than a single-contract proof.
EIP-8141 rewrite treats MAX_VERIFY_GAS as a shared mempool floor
Pull request 12301, opened September 5, 2026 against ethereum/EIPs, rewrites EIP-8141 so MAX_VERIFY_GAS is a shared mempool floor rather than a per-node maximum. Every public-mempool node must admit and propagate a transaction whose validation prefix stays within the floor, which the draft says should be set from the weakest node profile the network wants in the inclusion-list set, while extra local headroom never changes block validity. The numeric value stays 100,000. The PR is open and not merged, and the author flags the wording as a starting point for review.
Lido Oracle 8.0.6 caps VEBO exit reports at 500 requests
Lido research posted on August 31, 2026 that Lido Oracle 8.0.6 adds a temporary cap of 500 exit requests per Validators Exit Bus Oracle (VEBO) report. After the VEBO v3 upgrade, each exit request in submitReportData costs about 26.5k gas, and EIP-7825 (Fusaka) limits a single transaction to 16,777,216 gas, so a report with about 600 exits may not fit. The new iterator stops at 500 requests as a safe default (about 13.3 million gas, roughly 20% headroom) and leftover demand rolls into the next frames of about five hours. The change is oracle-side only: an external researcher reported the stuck-report risk, Lido says it is not a vulnerability and funds are not at risk, and only VEBO oracle committee members need to upgrade.
Optimism moves Unichain ProxyAdmin onto the OP Mainnet 2-of-2
A September 2, 2026 maintenance upgrade on the Optimism forum would move Unichain Mainnet (chain ID 130) ProxyAdmin ownership onto the same L1 and L2 ProxyAdmin Owners as OP Mainnet. On mainnet that shifts the current 3-of-3 Safe (Chain Governor, Foundation Upgrade Safe, and Security Council) to the standard 2-of-2, removing the Chain Governor from the owner set. ProxyAdmin at 0x3B73Fa8d82f511A3caE17B5a26E4E1a2d5E2f2A4 and DisputeGameFactoryProxy at 0x2F12d621a16e2d3285929C9996f478508951dFe4 would both point at 0x5a0Aae59D09fccBdDb6C6CcEB07B7279367C3d2A, the OP-governed L1 ProxyAdmin Owner. The post says the change is administrative, does not modify protocol behavior, and is meant to put Unichain on the shared security model needed for an atomic interop upgrade.
Magicians draft ERC-8407 for upgrade-free contract metadata
On September 2, 2026, conner asked Magicians for feedback on draft ERC-8407, Extensible Contract Metadata, before opening a pull request to ethereum/ERCs. Onchain metadata today usually means one purpose-built function per field, so a new convention forces a code change and often an upgrade that many deployed contracts cannot do. The draft standardizes a single key-to-value string surface (extraMetadata for reads, an optional writer, ExtraMetadataUpdated events, and ERC-165 advertisements), with empty values meaning removal. Later ERCs would define particular keys. This one only specifies the transport.
Coinbase restores Core DAO sends after a pause that ran nearly six days
Coinbase paused Core DAO Network sends and receives starting August 30, 2026 at 21:41 Pacific (August 31, 04:41 UTC), while buys, sells, converts, and fiat transactions stayed up. Status updates on September 6 at 14:08 Pacific identified the issue and said a fix was being implemented, then monitoring, then resolved at 14:09 Pacific (21:09 UTC). The pause lasted about 5 days and 16 hours. The incident is marked resolved with impact none.
