Will DeFi Survive This?

Thankless Nation, we have a bonus episode for you today because I think this uh requires almost a midweek look at what is going on in crypto. Specifically, what is going on with DeFi, David? So much going on with the curve protocol. I know you are fresh back from climbing mountains, but um the I need your help with

Yes. I need your help to understand what happened. Uh, can you give us the TLDR of what we're going to cover in today's episode?

Yeah, so there has been a series of events which have all one has led to another. There is a coding language called Viper, which is a an alternative to Solidity. So it is an Ethereum coding language that had

An exploit in the actual coding language that affected a certain number of DeFi protocols across Ethereum, especially and most importantly, Curve. Curve, which is a systemic, I would call a systemically important DeFi protocol, has had some very important uh pools, curve pools drained. Uh and that has led and put pressure on the CRV token specifically because the founder of Curve, Michael, uh has put up a bunch of CRV tokens as collateral across DeFi. So just to recap, a coding language had an exploit in it, which led to curve liquidations. And because the founder of Curve had so much CRV tokens as collateral across lending protocols, we are potentially on the cusp of a liquidation, uh cascading liquidations uh of the CRV token across DeFi, which might put holes into the balance sheets of many of these DeFi lending protocols. Did you catch that?

I did. And I'm so glad. We called David down from the mountains in order to uh to help us with this episode, David. I'm so glad you're back. I I think what we're trying to do in today's episode is just unpack this story and let let folks know as well that it's still developing. So we'll have more things to talk about. But but really in bankless fashion, we want to talk about like what just happened and the events in order to like learn from this, in order to level up on crypto. So we're going to discuss what happened, what's currently at risk right now. You might be wondering are my assets safe? Is this a systemic issue for all of DeFi? How scared should I be? And then finally, what we can learn. I think that's the that's the flow of this episode. David, you want to say anything else before we get ready to get in here?

Yeah.

Yeah, just uh a few more bits about curve and why it's so important. I would say curve is kind of a yin to yang of Uniswap, perhaps, um, but it's specifically meant for trading like-kind assets. So stable coins trade with stable coins, ether trades with other versions of synthetic ether. Uh, and so like staked ether trades with rocket pool ether or alchemix ether, which is one of the pool strains, uh is traded with uh uh, you know, ether. So like kind assets is what curve is really meant for. And it's got caught just a huge, huge amount of DeFi built on top of it. TVL in curve, total value locked in curve was 3.2 trillion

up to the point of billion

uh billion, excuse me, billion, trillion is a different number.

One site.

We'll do that. 3.2 billion down to 1.7 billion. So it takes like a 30% haircut in the TVL. Part of that is because the hacker uh stole money, but really most of it is that people kind of flee from this. And so we'll probably watch some of that uh TVL return. Uh, but the the total sum of uh all of the assets uh stolen by this exploiter by this exploit is about 70 million dollars.

But $20 ish million dollars of the uh stolen money was taken back by a white hat MEV bots, which is another very interesting part of this story. Uh so the hacker has gotten his uh stolen assets stolen from them, and some white hat MEV bots have returned some capital to some pools. So we have to unpack that as well. Uh and so uh this is gonna be uh there's a number of different rabbit holes to go down around this this particular topic. And we're gonna try and uh take our time to point towards each individual one.

Yeah, there's there's so much to talk about. And yes, what you need to know at the outset of this is curve is a very important protocol in all of DeFi. I would say systemically important, and it has certainly got a bullet wound uh here. So we're gonna explore all of that. Guys, we will be right back with the episode to walk you through everything that happened, what this means moving forward, and uh to answer the question is DeFi safe? Are we gonna make it? Uh, but before we do, we want to thank the sponsors that made this episode possible.

And we're back, Bankless Nation. When you hear the words EVM compiler reveals a zero-day vulnerability, it's not a good day. No, that's not scary.

That's scary. That's a very deep part of the tech stack. And so

there's something that actually we need to we need to define before we move on here. There's a specific kind of vulnerability here, and this is called a re entrancy attack. This is actually re entrancy attack, is actually how the DAO hack got hacked. And so a re entrancy, uh it's a very specific type of exploit. It's when a contract is

um checking to see the account balance of something, of someone, of some asset.

But the attacker is able to actually execute something

before the contracts are able to finish checking the state of something. And so it's like you are able to remove cash from the vending machine.

And then without before you finish the transaction, you actually could just keep on pressing, hey, withdraw my money. Hey, withdraw my money. Hey, withdraw my money. And so you you re-enter, I'm I'm doing my best as a non dev. You realize

Really good, honestly.

you reenter the same, like, hey, you owe me $15. Hey, you owe me $15. Hey, you owe me $15. And before you finish processing the transaction, you just say, hey, withdraw my $15, you know, 5,000 times. And then you finish the transaction. And it's $15 turns into, you know, $70 million.

That vending machine analogy is working for me, like just like the the mental imagery. So you you know you press D5 or whatever and you got your Snickers bar, but now you can keep hammering on that on that.

Before the vending machine delivers you the Snickers bar, you keep on saying, give me a Snickers bar. And then you do as Unlimited times, unlimited times. Yeah. So that's a very simple like re entrancy attack. That's how the DAO hack got

hacked. And sadly, because in the Viper language, the coding language that this uh vulnerability was expressed, forgot to did not have the appropriate checks, re entry re entrancy checks. So that's a very deep level of like why this is all happening to begin with.

Just really quick on Viper though. Okay, so it's an alternative to Solidity. It's much less used compared to Solidity. And so I'm not a developer, so someone come correct me. But uh my understanding is Solidity is a bit more like JavaScript-ish. Like and whereas

Vi Viper is Python, right? So it's kind of like Py Python derived. And so it's a different language. Um it was supposed to be more simple, a bit more functional, but it hasn't had a lot of adoption, but it does in in some uh in some pockets, including, you know, in curve, uh what we're about to talk about.

Yeah, so we're looking at a tweet thread here from Bankless HQ, our analyst Jack, who just did a bang up job really just covering all of this. And so if you want to read the tweet thread or also the newsletter, these are also fantastic sources. You can also read the uh the Viper tweet broadcasting the re-entrancy vulnerability in the next tweet, Ryan. Um, uh, the next tab that you got, or that one as well. Yeah. And so Viper language Twitter account says Viper versions 0.2, 15, 16, and 3 are vulnerable to malfunctioning re-entrancy locks. The investigation is ongoing, but any project relying on these versions should it should immediately reach out to us. The project, of course, in question is curve, as we said in the beginning. And so I think we've we've done a pretty good job explaining what curve is, but it is to put it into a metaphor, the marketplace for like kind assets. Uh, it is the place where tether gets turned into dye, where die gets turned into USDC, where USDC gets turned into uh uh you know any other stable coin. Uh and so not all curve pools.

were coded in Viper, only a certain number of them. And the not the curved pools that were coded in Viper have all been exploited by this one exploit. So a handful of contracts all for uh ETH pairs. Um and and so there are uh one, two, three, four pools that got exploited. PETH

with ETH pair,

uh, MS ETH with ETH, Al ETH from Alchemix. And so this is Pindle ETH. I can't remember what MS is. It'll uh metronome, uh, Alchemix, and then also the curve ETH pair itself, which is the curve DAO. And so

Pendle ETH, that is uh got drained for 6,000 ether. That's $11 million. Uh Alchemix ETH got drained for 1.6 million of ether, and then 1.8 million of uh uh metronome ETH, excuse me, not an Alchemix metronome. Metron uh Alchemix got drained for 7,200 oof ether, which is 13.6 million, and then 4.8,000 ether of Alchemix Ether, which is 9 million. And then the curve ETH pool, which is the source of all of this further contagion, got drained for 7,200 uh CRV, 7,000 7,200,000 CRV tokens, which is $5.1 million at the time of exploit. You can imagine that these curve token has gone down in price since, as well as 7,700 wrapped ether out of the curve Dow as and and then also 2,800 more Ether. Uh so if you sum it all together, it's about 70 million dollars. Um, that 70 million dollars came like up from my side uh four different protocols, one of them being curve. Uh, but it's really the source of this contagion and why this is getting up into a bigger and bigger story is that 7.2 million curve tokens that got taken out of the curve ether pool and is now in the hands of the attacker. Uh, and so that is the the recap of the assets that has been stolen out of curve.

Okay, so we'll talk about sort of why this why this matters and where we are right now, because this does have some wider implications that that's kind of spreading to other protocols here. We'll talk about that. But a quick side quest on how this actually works in practice. So my understanding, David, is that um some MEV bots captured some of the exploited funds here in the process, right? And maybe you can kind of explain how block building works and and how this um actually works. I was talking to some people who are um staking in in Rocket Pool, uh for for instance, some very large um call execution layer fees, right? Some MEV fees were uh

w were not not donated. I that's the wrong word. We're awarded to the rocket pool uh community essentially.

Like the Rocket Pool protocol processed the block that had a significant number of MEV bots bidding for some of the exploited funds. Exactly. And Rocketpool just happened to process the block. Therefore, a lot of these stolen funds turned into MEV and then got, you know, turned into rewards for Rocket Pool and a few others. But Rocket Pool has like, that's where kind of the conversation is because well, what does Rocket Pool do with the funds? Like

Well and what does

the answer here.

it basically spreads all of that those MEV proceeds across all of the

Individuals. Yeah. So a lot of stolen funds just got sprinkled out to individual rocket pool stakers.

Which is interesting. And I think a quick side quest here. Um, well, here's another one. So one MEV bot wasn't just Rocket Pool, this is an MEV bot called um coffebabe.eth um actually returned some of the money from the exploit. So it returned $5.4 million. So if you're an individual staker, right, and this is kind of like a lottery system, so it's a

bit of random chance as to whether you'll get this reward um in kind of the execution layer reward in MEV or not. But if you just suddenly receive $5.4 million worth of ETH in ill gotten gains, the question is, what do you do with it? Is it finders keepers, losers, weepers? Did you just find like, oh, I found $20 on the floor? I mean, you can't be like, hey, does anyone does anyone own this if if you find that out in public? But in this case, you actually kind of know who owns.

Right.

The the money. You could trace it. So what do you do? Do you refund it?

So I think it depends on the context, right? When we talk about rocket pool, and we're taking a very early uh rabbit hole down this one topic before getting into the rest of the contagion event. But this, so this is definitely a side quest, but it's this is just what happens so early in these cascades of events. Coffebabe.eth. Uh actually, I think I I need to check this if this is true, Ryan. But coffee, the coffee babe.eth.

Front ran created an N MEV bot after the first CRV ether liquidation in the time that the another

uh re-entrancy attack was going to happen again.

But the second time that the hacker tried to steal funds, I don't know why they're there what they didn't just do it all from the first uh from the first um

Uh exploit white. Why didn't they steal 100% of it? Some funds might have come in from bots. There's a bunch of extra questions here. There's a lot of dust to be settled. But in the time that the exploiter decided to attack the CRV ETH pool again, coffee babe.eth coded up an MEV bot and front ran that second and then also third exploits. And so in that second exploit, coffeebabe.eth front ran the exploiter and got 2,879 ether that was drained from the curve ether pool again. And then that is now being returned to the curve deployer address, which is um going to be able to actually determine where the the right uh destination of that ETH goes. Uh but that's just because this one person

Figured out a way to code up this MEV bot, take responsibility and control over stolen assets and stole money from a thief to return it like back to the rightful owners.

But like when it goes back to like, okay, what about a decentralized system like Rocket Pool? Like these are all interesting questions as to how to actually contend with some of these uh things.

Yeah, so I guess in this case, the coffee babe case, it's a bit more white hacky in that like they just exploited something the exploiter was exploiting, and then so they they refunded the funds. And that that to me is uh much more, I guess, morally clear. Yeah. Um what's less clear is the case where you have this big MEV reward and it's distributed uh across the pool of of say stakers, right? Like what what do you do? Do you actually practice and so what what's interesting?

That's the thing. That's kind of the punchline I think that that is important here because what I'm worried about, David, is I don't know if you've seen some some Mika legislation that came down the um bike uh last week, but there was some meek Mika legislation that basically would make it illegal to um benefit from MEV of this kind, like the unethical style of MEV. And uh I I get worried about that when that sort of thing is settled in Meat Space, because then we go down this path of well, do all validators have to be like checked by the state, AML KYC? Like how does the nation state actually enforce that? Because the protocol level's not. Anyway, it's an interesting side quest, but I agree with you that the best solution here is probably MEV burn, because then at least it's credibly neutral. And we sort of socialize these proceeds all over all ETH holders. I guess you know, we're socializing the guilt there.

I mean, I I would still put a white hat hacker ahead of that.

Uh because just because we're burning it doesn't mean we we are okay with people having their money stolen.

Agreed. Um well so let's get back to the to the main event. So what tweet are we looking at here?

Okay, so this is this is Tay uh Taylor Monaghan who we actually just did a Twitter space with talking about some of the white hat hack hackers and and uh you know just giving praise to coffee babe dot eth, you know, truly a babe. Um

But we but we need to get into the contagion event that is around CRV because as soon as CRV is sold, first, there's not that much liquidity right now. I don't know if you notice prices, Ryan, but you know, as bullish as we are, we're still in the bear market. So liquidity is already thin. And then when the CRV ether pool of where CRV gets its liquidity gets exploited, you would imagine that liquidity goes A for that reason, and then B, because anyone else also supplying liquidity to curve token around DeFi gets scared of getting dumped on. So they withdraw their liquidity. So now

We're at we're at the point of the story where the the contagion is kind of um around surrounding curve the token, right? CRV the token.

Yes, exactly. And so CRV, the token liquidity starts to drain. We accidentally see a flash crash of curve down to about 10 cents from 70 cents. And so inside of a very small period of time, curve went from 70 to 10 cents

and then back up to 60 cents pretty quickly, pretty quickly, without liquidating curve collateral across various DeFi lending protocols. But you can see how, I mean, I remember Terra Luna. I I remember how how, and then the curve is not Terra Luna. Never forget. But you we all remember how like liquidity just drained very quickly of surrounding uh surrounding these assets when it needed it the most. Hey Bankless Nation, in this section you're about to hear, I say 8% of curve tokens. I actually meant 0.8%. I'm off by one order.