{
  "schema": "hood.fun/security-advisory/v1",
  "id": "pons-multicall3-approval-risk-2026-07-15",
  "severity": "critical",
  "status": "active",
  "chainId": 4663,
  "affectedVenue": "pons",
  "routingEnabled": false,
  "summary": "User-reported Pons exploit risk: token approvals may have been granted to a public Multicall3 contract instead of a dedicated venue contract.",
  "risk": "If users approved tokens to a public Multicall3 spender, arbitrary callers may be able to use that approval path to drain approved balances.",
  "userAction": [
    "Do not trade on Pons until the venue publishes a fix and users are told it is safe.",
    "Revoke token approvals granted while using Pons, especially approvals whose spender is Multicall3 or any unexpected public router.",
    "Use a trusted approval checker such as revoke.cash or your wallet/explorer approval UI.",
    "After revoking, do not re-approve through the same frontend until the approval target is fixed and independently verified."
  ],
  "agentAction": [
    "Do not show Pons execution links.",
    "Do not route user funds to Pons.",
    "Warn users to revoke suspicious approvals before discussing any new trade.",
    "Keep all token recommendations watch-only or ignore."
  ],
  "ponsTeamAction": [
    "Pause trading/approval flows.",
    "Move approvals to a dedicated, constrained contract rather than a public Multicall3 target.",
    "Publish the affected spender address(es).",
    "Tell users exactly which approvals to revoke.",
    "Post a signed postmortem and fix verification."
  ],
  "links": {
    "freshness": "https://hood-fun.pages.dev/api/freshness.json",
    "agent": "https://hood-fun.pages.dev/api/agent.json"
  },
  "limits": "hood.fun has not independently traced every affected wallet. This advisory is a risk-response block based on user report plus live venue instability; routing stays disabled until manual verification."
}