Analysis: Is the Curve crisis over? Why the founders are crazy about selling coins

Author: GaryMa Wu said blockchain

The Curve protocol recently had four fund pools stolen due to a bug in a specific version of the Ethereum programming language Vyper; in addition, because the founder of Curve used a huge amount of CRV as collateral on multiple lending platforms Borrowing also put CRV into a potential liquidation crisis. This article starts from the two perspectives of Bug crisis and CRV crisis to help readers sort out the current situation of each crisis and potential solutions in the future.

Bug crisis: resolved, some funds recovered

The essence of Curve's vulnerability crisis this time is that there is a bug in several specific versions (0.2.15, 0.2.16, and 0.3.0) of the Ethereum programming language Vyper, which causes the reentry lock protection to fail.

For this vulnerability, the affected fund pools and the corresponding stolen amounts are:

● pETH/ETH | 6,106.65 WETH (~$11m)

●msETH/ETH| 866.55 WETH (~$1.6m) and 959.71 msETH (~$1.8m)

●alETH/ETH|7,258.70WETH (~$13.6m) and 4,821.55 alETH (~$9m)

●CRV/ETH | 7,193,401.77 CRV (~$5.1m based on the stolen price), 7,680.49 WETH (~$14.2m) and 2,879.65 ETH (~$5.4m)

● In addition, Tricrypto (USDT+WBTC+ETH) on Arbitrum is also affected, but there is no profitable attack yet, and the security of funds will not be affected, but the official recommends that users also withdraw funds first.

The current deposit and pledge functions of the first four affected fund pools have been disabled, and they have also been removed from the fund pool interface. Next, the official will stop the CRV emission of these pools, and then open new ones for alETH, msETH and pETH. The new fund pool will be paired with WETH or implemented with other new ETH pools. For CRV, it has been paired with crvUSD+ETH to form a new Tricrypto pool, which is no longer affected by the re-entry vulnerability . **

This attack is mainly affected by the five pools that use the specific Vyper version mentioned above and paired with native ETH. The other pools on Curve are essentially safe and unaffected, so they are now abandoned. After using these affected pools and opening new pools (either paired with WETH or compiled with a secure Vyper version), this Curve vulnerability crisis can be considered resolved (assuming the new Vyper version has no unknown vulnerabilities lol).

As for the stolen funds, c0ffeebabe.eth, the previous Mev Bot deployer, has returned 2,879.54 ETH. For other stolen funds, the current on-chain detective @zachxbt seems to have found some potential suspects, and hopes to try to recover some funds in the future to reduce the loss of stolen users.

CRV liquidation crisis: high probability to be resolved, OTC sells coins to repay debts

CRV's liquidation crisis mainly came from Curve founder Michael Egorov's mortgage loans on lending platforms such as Frax Finance and Aave.

Although the price on the CRV chain plummeted to around $0.08 in an instant after the vulnerability incident, since the price feed of the oracle on the chain refers to the weighting mechanism of multiple data sources and dimensions, this kind of sudden drop will not actually trigger these The liquidation mechanism of the lending platform. In the follow-up, despite the strong sentiment towards CRV in the market, the price of CRV remained stable above $0.5. In the short term, the liquidation price of Michael Egorov's positions on Frax Finance and Aave was basically around $0.35, which still seemed to have a buffer of 30% Space, the crisis does not seem so urgent?

The main stress here is the debt position in Fraxlend: since Fraxlend implements time-weighted variable rates, this position actually poses a greater risk to CRV. At 100% utilization of Fraxlend, the rate will double every 12 hours and is expected to increase to a maximum of 10,000% after 3.5 days. This ultra-high interest rate could eventually lead to liquidation of Michael's position, regardless of the price. With a maximum LTV of 75%, the position liquidation price would reach $0.517 within 4.5 days.

However, at present, Curve founder Michael Egorov seems to have found a way to break the situation, that is, through "OTC transactions to sell CRV to repay debts."

According to monitoring by @EmberCN, Curve founder Michael Egorov has sold a total of 54.5 million CRVs and received $21.8 million in funding. The buyers of these CRVs include DWFLabs (12.5 million CRVs), Justin Sun (5 million CRVs), Huang Licheng (3.75 million CRVs), Cream.Finance (2.5 million CRVs), etc., with an average price of $0.4.

As of the time of writing this article, the lending positions of Curve founder Michael Egorov on various lending platforms are roughly as follows:

● 257.44m CRVs were supplied on Aave v2, 49.25m USDT was lent out, and the liquidation price was about $0.35.

● 38.6m CRVs were supplied on Frax, and 9.19m FRAXs were lent, with a liquidation price of about $0.3.

● 46.65m CRVs were supplied and 12m MIMs were loaned out on Abracadabra.

● Inverse has supplied 29.1m CRV and lent 7.7m DOLA.

In addition, the liquidation pressure of CRV is not only from the borrower, but also from the lending platform. Now all lending platforms understand that this loan is a time bomb. If it is not handled properly, it will cause bad debts on the platform or affect the assets of other users on the platform.

According to @Loki_Zeng's statement, we can know that the solutions of each lending platform are as follows:

● Fraxlend's mechanism is perfect: loan pool risk isolation + dynamic interest rate, without any additional measures, Michael needs to take the initiative to repay the money.

● Aave maintains the decentralization of governance, but does not have the ability to act quickly: the discussion in the governance forum is more sufficient and timely. The current consensus is to reduce Curve's LTV to 0 and freeze new loans. However, other proposals, such as lowering LT (liquidation threshold) and raising interest rates, are still relatively controversial.

● Abracadabra achieves efficiency and is slightly autocratic: it proposes a strategy of applying collateral interest to CRV cauldrons, that is, all interest will be charged directly on the collateral CRV of cauldrons and immediately transferred to the agreement treasury to increase The DAO's reserve factor. Once in the treasury, the collateral can be converted into MIM through on-chain transactions or offline partners.

● Inverse is currently silent.

In fact, looking back at this whole incident, Curve itself, as a liquidity & trading platform, has no obvious fault. Although its fund pool was stolen and user funds were damaged, the essence of the vulnerability is the fault of the Ethereum programming language Vyper. As for the liquidation crisis of the CRV price drop, it was essentially caused by Michael Egorov’s personal behavior. He mortgaged about 100 million US dollars in cash, and personally planted a time bomb for CRV and the lending platform. In addition, through this incident, it is also a lesson for the lending platform: how to better realize the safe isolation of user funds and a reasonable and efficient liquidation mechanism?