Indigo Patches Vulnerability Identified by TxPipe

Indigo Protocol announced on October 19 that it had completed a patch addressing a vulnerability discovered by TxPipe. The finding emerged from regular AI-assisted threat analysis conducted with the Indigo Foundation. According to Indigo, user funds were never at risk between the alert and completion of the upgrade.

TxPipe Review Leads to Priority Patch

Indigo reported that a recent security review identified a vulnerability requiring a priority patch. It credited TxPipe for the discovery and its continuing security work with the protocol.

TxPipe previously audited Indigo V3 in May 2026. The protocol’s published audit history also includes earlier assessments by Tweag and MLabs.

The announcement did not disclose the vulnerability’s technical cause, severity classification, or affected contracts.

Indigo DAO Approves On-Chain Deployment

Indigo is a synthetic assets protocol on Cardano. Users lock collateral to create tokens designed to track other assets, including a synthetic dollar.

Its V3 release expanded collateral support beyond ADA and introduced a peg stabilization module alongside changes to its order system.

Protocol upgrades pass through DAO governance. Participants vote using staked INDY, with voting power determined by the amount staked when they cast their vote.

For the security patch, Indigo reported that the DAO approved the upgrade before its autonomous execution on-chain. The announcement did not include the proposal identifier, voting breakdown, or deployment transaction.

[NEWSBREAK]

Indigo Reports Funds Were Safe During Response

Indigo’s safety statement specifically covered the period between notification and completion of the upgrade. The team did not provide a technical account of potential exposure before the alert.

The patch announcement described deployment as complete. It contained no instructions for users to move collateral, migrate positions, or submit recovery requests.