It’s as miraculous as when Aladdin took off on the magic carpet: in the first possible form, some users of the decentralized financial protocol, who put the “rugpull” concept on their heads, could benefit from the exploit today.
Colloquialism for cases where liquidity is depleted from a project (often a ruthless founder or developer who drains funds on its own), depositors and DeFi users are most often the ones holding bad debt and / or worthless tokens – it remains to be hoped for compensation plans that they can take months or even years before you change completely.
In today’s abuse, however, users are the ones who have had to pull the seams for a change.
This morning, Alchemix announced that contracts for one of their synthetic assets, alETH, had “incidented”.
There was an incident with Alchemix alETH contracts. Along with a fantastic team on @iearnfinance, we have identified the error and are working on both the autopsy and the resolution of the problem.
The funds are safe.
– Alchemix (@AlchemixFi) June 16, 2021
In an incident report released later in the day, Alchemix developer “n4n0” said that “the vault deployment script problem mistakenly created additional safes”, some of which he used to incorrectly calculate outstanding debts, which in turn meant protocol resources. were used to “repay users’ debts”.
As a result, for a short time, users were able to withdraw their ETH collateral with outstanding ALETH loans – a $ 6.5 million community intervention.
Alchemix innovates again … this time with inverted rugpull … and ‘rugput’
If we’re kidding, there’s been a small incident with the new alETH safe, in which no one has lost any money, but some users have actually gained@ n4n084191635 with great news about the incident herehttps://t.co/Vo3cWRnZPx pic.twitter.com/68G3y1s3x0
– ⟠ toast.eth (@intocryptoast) June 16, 2021
According to the incident report, the team suspended the mint contract at ALETH two and a half hours after the discovery was discovered. The report states that no users lost funds as a result of the misuse and that Yearn.Finance – whose proceeds automatically repay Alchemix’s synthetic loans – also suffered no losses. In addition, the “conservative” initial debt ceiling prevented a more extreme loss of protocol.
The team, including the author of the n4n0 incident report, appears to have taken the loss with caution:
– n4n0 (@ n4n084191635) June 16, 2021
A trio of solutions is deployed to cover the deficit, including a temporary increase in protocol fees, an injection of ETH liquidity from the Alchemix cash register, and a sale of DAI from the cash register for another ETH. The team says it will deploy a brand new safe to address the shortcomings of the original.
Other changes may also be on the horizon for ALETH assets. Alchemix currently has an AlETH / ETH pool live on Saddle, a VC-supported Curve Finance fork, after Curve reportedly refuses to create a fund for synthetic Ether. However, in the last 48 hours, the Curve social media account has been created overtures in an effort to bring back the latest synthetic asset of Alchemix.