Curio, a real-world asset (RWA) liquidity firm, experienced a smart contract exploit due to a critical vulnerability associated with voting power privileges, resulting in the theft of $16 million in digital assets.

The company promptly notified its community about the exploit and assured them that measures were being taken to address the situation. It was revealed that a MakerDAO-based smart contract utilized within Curio had been compromised.

However, Curio reassured its users that the exploit was limited to the Ethereum side, emphasizing that all contracts related to Polkadot and the Curio Chain remained unaffected.

Cyvers, a Web3 security firm, estimated the losses resulting from the exploit to be around $16 million, attributing the breach to a "permission access logic vulnerability."

On March 25, Curio released a post-mortem report on the exploit along with a compensation plan for affected users. The report identified a flaw in the voting power privilege access control mechanism as the root cause of the problem.

The attacker managed to obtain a small number of Curio Governance (CGT) tokens, granting them elevated voting power within the project's smart contract. This enabled the execution of unauthorized actions, leading to the creation of 1 billion unauthorized CGT tokens.

Curio pledged to return all funds affected by the exploit and announced the introduction of a new token, CGT 2.0, to restore 100% of the funds for CGT holders.

For liquidity providers impacted by the incident, Curio outlined a fund compensation program spanning four stages, each lasting 90 days. This could potentially result in full reimbursement taking up to one year.

Additionally, the company stated its intention to reward white hat hackers who assist in recovering the lost funds, offering a reward equivalent to 10% of the funds recovered during the initial recovery phase.