Author: GaryMa, WuBlockchain

The Curve protocol recently encountered a major challenge when a bug in older versions of the Vyper compiler caused a security feature to fail in certain Curve pools.Furthermore, the founder’s massive collateralization of CRV on multiple lending platforms led to a potential liquidity crisis for CRV. In this article, we will examine both the Bug Crisis and the CRV Crisis, providing insights into the current state of each crisis and potential solutions.

Bug Crisis: Resolved, Partial Fund Recovery

The crisis in Curve arose from a vulnerability in specific versions of the Vyper language (0.2.15, 0.2.16, and 0.3.0), causing reentrancy protection to fail. The affected liquidity pools and their corresponding stolen amounts are as follows:

• pETH/ETH | 6,106.65 WETH (~$11m)

• msETH/ETH | 866.55 WETH (~$1.6 m) and 959.71 msETH (~$1.8m)

• alETH/ETH | 7,258.70 WETH (~$13.6 m) and 4,821.55 alETH (~$9m)

• CRV/ETH | 7,193,401.77 CRV (~$5.1m at time of exploit), 7,680.49 WETH (~$14.2m), and 2,879.65 ETH (~$5.4m)

• Additionally, the Tricrypto pool (USDT+WBTC+ETH) on Arbitrum was affected, but no profitable attacks were observed, and user funds remained secure. Nonetheless, users were advised to withdraw their funds as a precaution.

The four affected pools had their deposit and staking functionalities disabled and were delisted from the interface. Going forward, the Curve team plans to halt CRV emissions for these pools and create new ones for alETH, msETH, and pETH, pairing them with WETH or implementing them using a secure version of Vyper. For CRV, a new Tricrypto pool was formed by pairing it with crvUSD+ETH, eliminating the vulnerability to the reentrancy bug.

These five pools that use the specific Vyper version mentioned above and are paired with native ETH are primarily affected in this attack, while the other pools on Curve are essentially safe and unaffected. So now that we’ve dropped these affected pools and opened new ones (paired with WETH or compiled with a secure version of Vyper), the Curve bug crisis can be considered resolved (assuming the new Vyper version has no unknown bugs).

CRV Liquidity Crisis: Likely Resolved, OTC Selling for Debt Repayment

The CRV liquidity crisis primarily resulted from Curve founder Michael Egorov’s significant collateralization of CRV for borrowing on Frax Finance and Aave lending platforms. Although the on-chain price of CRV briefly plummeted to around $0.08 after the bug incident, the decentralized oracle mechanism, relying on multiple data sources and weighted averages, prevented this sharp price drop from triggering liquidation mechanisms on these lending platforms. Despite bearish sentiment in the market, CRV’s price has stabilized around $0.5. Furthermore, Michael Egorov’s positions on Frax Finance and Aave show a substantial buffer, with liquidation prices around $0.35, suggesting a 30% margin of safety.

Michael Egorov appears to have found a solution to the crisis through “OTC trading of CRV to repay debts.” According to @EmberCN, Michael Egorov has sold a total of 54.5 million CRV tokens, raising $21.8 million. The purchasers of these CRV tokens include DWFLabs (12.5 million CRV), Justin Sun (5 million CRV), Machi (3.75 million CRV), and Cream.Finance (2.5 million CRV), at an average price of $0.4.

As of the time before the article’s publication, the lending positions of Curve founder Michael Egorov on various lending platforms are approximately as follows:

• 257.44 million CRV supplied on Aave v2, borrowed 49.25 million USDT, with a liquidation price of approximately $0.35.

• 38.6 million CRV supplied on Frax, borrowed 9.19 million FRAX, with a liquidation price of approximately $0.3.

• 46.65 million CRV supplied on Abracadabra and borrowed 12 million MIM.

• 29.1 million CRV supplied on Inverse and borrowed 7.7 million DOLA.

In addition, the pressure of CRV liquidation affects not only borrowers but also lending platforms. All lending platforms now realize that this loan is a ticking time bomb, and mishandling it could lead to platform losses or impact the assets of other users on the platform.

According to @Loki_Zeng, the solutions provided by various lending platforms are as follows:

• Fraxlend has a robust mechanism: risk isolation of lending pools + dynamic interest rates, requiring no additional measures; Michael will need to repay the debt voluntarily.

• Aave maintains decentralized governance but lacks agile action capabilities: discussions on the governance forum are extensive and timely. The current consensus is to reduce the CRV LTV to 0 and freeze new borrowing, but other proposals, such as lowering the LTV (liquidation threshold) or increasing interest rates, remain contentious.

• Abracadabra aims for efficiency with a slight touch of autocracy: They proposed applying interest on collateral to the CRV cauldrons, where all interest will be directly collected on CRV collateral in the cauldrons and immediately moved into the protocol treasury to increase the DAO’s reserve factor. Once in the treasury, collateral can be converted to MIM through on-chain transactions or partnerships.

• Inverse has not made any official announcements regarding a solution yet.

In retrospect, Curve, as a liquidity and trading platform, was not at fault for the crisis. Although it was the theft of its funds pool that resulted in the loss of user funds, the vulnerability was essentially the blame of the Ethereum programming language Vyper. As for the CRV price drop and liquidity crisis, it can be attributed to Michael Egorov’s actions, as he collateralized approximately $100 million for liquidation, setting a timed bomb for CRV and lending platforms. This event has also served as a lesson for lending platforms to better implement user fund security isolation and efficient liquidation mechanisms.

Related Links:

https://hackmd.io/@LlamaRisk/BJzSKHNjn

https://twitter.com/Loki_Zeng/status/1686624941171720192

https://zapper.xyz/account/0x7a16ff8270133f063aab6c9977183d9e72835428?tab=apps

Follow us
Twitter: https://twitter.com/WuBlockchain
Telegram: https://t.me/wublockchainenglish