0.7.1 loomdesk-hq/sdk
GitHub releaseSource-backed
Why it matters: One of a run of ships in the 30 days to it: building continued, not a one-off.
0.7.1 (2026-11-02) Four low findings from Hey Research Lab's read of 0.7.0, all under the same threat model as before (a hostile plan reaching a trusted contract), none exploitable by LoomDesk's own plans, none seen on chain: · The router check accepted the router itself… Show allShow less
- 0.7.1 (2026-11-02) Four low findings from Hey Research Lab's read of 0.7.0, all under the same threat model as before (a hostile plan reaching a trusted contract), none exploitable by LoomDesk's own plans, none seen on chain:
- The router check accepted the router itself (ADDRESS_THIS) as a recipient without asking whether the execute moved everything back out. A plan could wrap the wallet's ETH to the router, or pull tokens to it with Permit2, and end there: the router keeps no balances, so anyone sweeps them in the next transaction. Now every currency routed to the router must leave it…
Record ship:3e761f00… · HEY counts it as building; it does not judge the release’s quality or what it means for the token.
