Silicon Valley Bank and DeFi; The Rise of GMX
The Fall of Silicon Valley Bank; DeFi has a "Come to Jesus" Moment; The Rise of GMX; The Wormhole hacker gets Jumped
Dear Bankless Nation š“,
In this edition of the DeFi Download, weāre going in a slightly different direction but still giving you the education content youāre used to. Today, weāre focusing on the fall of Silicon Valley Bank and some of the waves it made in the DeFi ecosystem, specifically Circleās USDC and Makerās DAI. Buckle up, this one gets into the weeds.
Afterwards, Austin gives us the down low on GMX and how it grew to overtake dYdX as the dominant derivatives protocol. Finally, he takes us through a stranger-than-fiction story of how the Wormhole hacker lost their stolen funds.
If you like the new direction of the DeFi Download, let us know in the comments!
This is the DeFi Download ā”ļø
Contributors: BanklessDAO Writers Guild (Jake and Stake, Austin Foss)
This is the official newsletter of BanklessDAO. To unsubscribe, edit your settings.
Silicon Valley Bank | Jakeās Take
Author: Jake and Stake
Background
Banks earn money by borrowing money from depositors and loaning that money (and more) to borrowers. They make money by earning a greater return on their loans than what they pay out in interest on their deposits. Depositors are technically creditors to their banks.
During COVID lockdowns from 2020 through 2021 banks received a ton of deposits.
āBetween the end of 2019 and the first quarter of 2022, deposits at US banks rose by $5.40 trillion. With loan demand weak, only around 15% of that volume was channelled towards loans; the rest was invested in securities portfolios or kept as cash.ā - Marc Rubinstein
Weāll talk about two kinds of fixed income securities: Available for Sale (AFS) and Hold to Maturity (HTM). From ChatGPT:
What is the difference between AFS bonds and HTM securities?
AFS securities are those that a company holds as investments with the intention of selling them in the future, but not necessarily in the short term. These securities are reported on the balance sheet at fair value, with unrealized gains or losses recorded as a separate component of shareholders' equity.
HTM securities are those that a company intends to hold until they mature. These securities are reported on the balance sheet at amortized cost, which takes into account both the purchase price and any interest earned over time.
The main difference between AFS and HTM is how they are accounted for on the balance sheet. AFS are marked to market, meaning their value is adjusted to reflect changes in market interest rates, and unrealized gains or losses are recorded in shareholders' equity. HTM, on the other hand, are accounted for at amortized cost, meaning that their value is not adjusted for changes in market interest rates, and unrealized gains or losses are not recorded on the balance sheet.
Companies may choose to hold AFS or HTM securities based on their investment objectives, risk tolerance, and accounting considerations. AFS securities may be more appropriate for companies that want the flexibility to sell their investments in the short term and are willing to accept greater volatility in the value of their investments. HTM securities may be more appropriate for companies that want a stable source of income and are willing to hold their investments until maturity.
The economic environment in 2020 was that of high inflation and low interest rates. Banks were holding a ton of AFS bonds and after 2020 reclassified them to HTM in 2021 in order to avoid future losses on their balance sheets because the unrealized loss would no longer appear on the bankās account. As a result, ratios of AFS went from Ā¾ to Ā½ of all bank securities.
Silicon Valley Bank
SVB is one of the premier financial service providers to the tech ecosystem in Silicon Valley. Founders use it for personal accounts (checking and savings), to receive home and auto loans, and hold company funding.
They make most of their money (73%) through Net Interest Incomeāloaning money received by depositors to start ups and earning yield in fixed income investments (treasuries and mortgage backed securities. And from 2020-2021 business was booming.
Silicon Valley Bank (SVB) received a ton of deposits during that time because the economy was flush with cash (money printer go brr). The banking industryās deposits grew by a staggering 37%, but SVB deposit balances tripled to $198 billion.
ā of these deposits were into plain checking accounts with 0% interest
ā of these deposits were into accounts with small interest rates
They had just received a butt load of money and were figuring out what to do with it. The bank wanted to achieve yields of 1.65%-1.75% so they ended up investing some into short-duration AFS assets, and in search of more yield, they put the rest into long-dated HTM assets.
And it was profitable:
[The] AFS book grew from $13.9 billion at the end of 2019 to $27.3 billion at its peak in the first quarter of 2022; the longer duration HTM book grew by much more: from $13.8 billion to $98.7 billion. - Marc Rubenstein
Like many other bond portfolios, HTM securities took an ever larger portion of the bankās assets, and the vast majority of those assets were mortgage-based loans. These are considered high-quality assets unlike the junk bonds that caused the 2008 housing crisis.
But this strategy is very sensitive to interest rate risks; something SVBās Chief Risk Officer would have told them if they had one. The previous risk officer left in April 2022, just before the Fed raised rates and just after selling $4 million in shares.
The Fed raises rates
After a couple years of ātransitory inflationā, and advising that they would not raise rates, the Fed raised rates in 2022. This would be the sharpest interest rate hike since World War II.Ā
As interest rates rose, the yields on newly issued bonds were improving against those previously issued, causing the value of the old bonds to decrease. Why buy a 10 year treasury with 1% interest when you could get a new one with 3.5%?
The value of the HTM portfolio fell by 17% over the course of 2021-2022 with unrealized losses of $16 billion. At the end of September SVB was technically insolvent because they only had $11.8 billion in tangible common equity on hand to absorb those losses, leaving more than $4 billion of liabilities unpayable.Ā
Note that these losses were unrealized. Meaning SVB didnāt have to record it on their balance sheet, and as long as they held them to maturity, they could weather the storm.
But as the economy began to cool down, deposits began to fall from that $198 billion peak I mentioned before to $165 billion in 2023. Remember, startups get money by raising capital from VCs and VC money is drying up.
The bankās customers (startups and VCs) have less money to deposit, meaning SVBās credit line was falling, and the bankās balance sheet wouldnāt be able to handle much more without selling a bunch of AFS securities and raising capital (~$2B).Ā
In short, SVB management (and a lot of other banks) f***ed up big-time by trying to chase greater yields and SVB needed to cover their hides before Moodyās downgraded their debt. From the Financial Times:
The deal was announced on Wednesday night but by Thursday morning looked set to flop. SVBās decision to sell the securities had surprised some investors and signalled to them that it had exhausted other avenues to raise cash. By lunchtime, Silicon Valley financiers were receiving last-ditch calls from Goldman, which briefly attempted to put together a larger group of investors alongside General Atlantic to raise capital, as SVBās share price was tanking.
At the same time, some large venture investors, including Peter Thielās Founders Fund, advised companies to pull their money from SVB. Becker, in a series of calls with SVBās customers and investors, told people not to panic. āIf everyone is telling each other SVB is in trouble, that would be a challenge,ā he said. Suddenly, the risk that had been building on SVBās balance sheet for more than a year became a reality. If deposits fell further, SVB would be forced to sell its held-to-maturity bond portfolio and recognise a $15bn loss, moving closer to insolvency.
Unfortunately, deposit outflows were outpacing the sale process and that $2B wasnāt raised before they made the announcement, but they would be fine as long as they didnāt have to sell their HTM securities (and realize those huge losses). They would be fine as long as there wasnāt a bank run.
The Bank Run
Basically, in a classic run, whoever tries to take their money out of a bank first will be able to get all of it out, while the latecomers will lose their money when the bank fails. This means that runs are self-fulfilling prophecies ā as soon as a critical mass of people all believe a bank is likely to suffer a run, they all stampede to pull their money out at once in an attempt to get in ahead of everyone else. And this stampede is the run. - Noah Smith
The Banking Act of 1933 established federal deposit insurance limited to $2,500. The bill was in part created to stem the bank runs that had been occurring in years prior and give depositors confidence in the US banking system. Once everyone understood that the Federal government would cover any losses, there was no fear of losing money and the bank run stopped.
Today, the FDIC insurance limit is up to $250,000. This is reasonable for everyday individuals. Very few people need more than $250K for everyday expenses and the people do likely have other risk management tools at their disposal.
But businesses are a different story. Many businesses need to have liquid cash in order to pay salaries, operating costs, and other various expenses. Most are not thinking about managing banking risks. Especially in a place like Silicon Valley, where there are hundreds of small startups focused on surviving and finding product-market fit and not on interest rate risk.
There was a lot of uninsured money in SVB. Over 37,000 accounts in SVB (93%) held balances in excess of $250,000, with an average balance of $4.2 million ($155.4 billion total). VCs realized that a lot of their companies had money in the bank that was not insured, so they urged their portfolio companies to move their money ASAP. One domino fell after another in what would be the fastest bank run in history: $42 billion in withdrawals was initiated on March 9th, 2023.
The Fed, Treasury, and FDIC walk into a bank
The Federal Reserve released a statement on March 12, 2023 that they would step in to make sure depositors would not lose their money in the Silicon Valley Bank closure:
āAfter receiving a recommendation from the boards of the FDIC and the Federal Reserve, and consulting with the President, Secretary Yellen approved actions enabling the FDIC to complete its resolution of Silicon Valley Bank, Santa Clara, California, in a manner that fully protects all depositors. Depositors will have access to all of their money starting Monday, March 13. No losses associated with the resolution of Silicon Valley Bank will be borne by the taxpayer.ā - Joint Statement by Treasury, Federal Reserve, and FDIC
Suspiciously, Signature Bank would also be closed by the FDIC.
Later it was announced that:Ā
ā[...] additional funding will be made available through the creation of a new Bank Term Funding Program (BTFP), offering loans of up to one year in length to banks, savings associations, credit unions, and other eligible depository institutions pledging U.S. Treasuries, agency debt and mortgage-backed securities, and other qualifying assets as collateral.ā - The Federal Reserve Board
In essence, a buyout from the private sector was not made as many expected. Instead, the Federal Reserve will provide for institutionsā deposits in order to instill faith in the US banking system. The United States government is loaning money to SVB against the purchase price of their assets.
This means two things. One, the federal government is injecting liquidity into the banking system in exchange for these particular securities (Treasuries/MBS). In effect, thereās no risk to buying these bonds because you can always exchange them for cash, no matter what their mark-to-market value is.
Two, the $250,000 insurance limit is meaningless. All deposits will be insured by the FDIC.
There will, though, be long-term consequences for fundamentally changing the nature of a bank: remember, depositors are a bankās creditors, who are compensated for lending money to the bank; if there is no risk in lending that money, why should depositors make anything? Banks, meanwhile, are now motivated to pursue even riskier strategies, knowing that depositors will be safe; the answer will almost certainly be far more stringent regulation on small banks, of the sort imposed on the big four after 2008. That, in turn, will mean tighter credit and more fees for consumers, in addition to what will be a big increase in FDIC insurance premiums. And, while taxpayers may not be directly infusing money into failing banks, taking on all of those low-interest rate securities is [a] real opportunity cost. - Ben Thompson
Weāll see increased regulation on smaller banks, increasing transaction costs and tighter credit for consumers. All of this leads to a lower velocity of money and an economic slow-down in the US. Finally, if the regulation is ineffective (and depending on the length of the program), weāll continue to see the government handing out cash in exchange for underwater assets.
As yields on savings accounts fall, I expect more people to put their assets in money market funds. Those with an appetite for more risk and an exhaustion with the US dollar might put their money in DeFi. As the banking sector heats up (explodes?) more people will see the value-proposition of crypto economic systems and flee hard assets like gold, energy, real estate and, of course, digital currencies.
The Crypto Ecosystem
Ethereum would go on to rally at the news of SVBās effect on the financial system. Maybe having an economic system independent of a centralized government is actually useful.
Meanwhile, the stablecoin market would be affected quite differently by news of SVB and a possible banking collapse.
Impact on USDC
Circleās USDC is backed by a combination of cash and US Treasuries and USDC is always redeemable 1 for 1 with the U.S. Dollar. But Circle was already going through turbulent times as it had been impacted by the closures of two core transaction banking partners: Silvergate and Signature Bank.
On Thursday March 9th Circle initiated a transfer out of SVB, but $3.3 billion of those assets were held in SVB before Circleās transfers could be settled.
As uncertainty around SVBās solvency created panic in crypto Twitter, USDC would lose its peg over the weekend.Ā
But once the Federal Government stepped in, Circle moved cash deposits to BNY Mellon, and all was well. Today, most of the Circle Reserve Fund (which helps back USDC) is held in Blackrock and BNY Mellon. Note that BNY Mellon has a wider margin of safety as of Dec. 31 2022:
39% HTM securities
61% AFS securities
Though the US banking industry is far from safe.
DAI and Makerās Response
If you didnāt already know, a lot of DAI is backed by USDC.
Maker provides a way for users to swap USDC (and other stablecoins) for DAI and vice versa using their Peg Stability Module (PSM). This module helps keep DAIās peg to $1 USD by way of USDC-DAI arbitrage opportunities. Currently, the PSM holds 3.1 billion USDC.
From my article last September, DAI a Different Stablecoin:
Users can deposit USDC and generate DAI at a 1ā1 ratio, no matter the price. The constant one-to-one exchange allows users to arbitrage DAIās price.
The PSM allows users to swap their stablecoins for DAI and vice versa, and the DAO can take a fee on swaps. So if DAI is trading above its peg, users perform an arbitrage trade. By depositing other stablecoins to receive DAI at a 1ā1 ratio (minus the swap fee which is currently 0) and selling it on the open market. Similarly for the inverse.
The PSM mechanism will tighten DAIās range to its peg of $1 by acting as a release valve when the value of DAI swings too widelyāusually as a result of volatility. After the SVB collapse, USDC holders were suddenly spooked, so the USDC-PSM saw a flurry of activity:
Ā Makerās exposure to USDC doubled to $4 billion over the weekend following SVBās closure.
This is good if DAI is more volatile than other PSM tokens, but this arbitrage opportunity means that DAI is correlated with stablecoins. The PSM acts as a tether that pulls the two assets together, and where one goes so does the other, and DAI fell too:
This was enough to push Makerās Risk Core Unit to submit an emergency proposal to limit exposure to USDC. They reduced the USDC-PSM daily USDC/DAI mint to $250 million DAI. This way Maker could loosen that tether mentioned before. They also increased the USDC ā DAI swap fee to 1%.
To tie DAI more closely to a different stablecoin (and encourage users to hold DAI), they did the reverse for the USDP-PSM:
Raised debt ceiling
Lowered fees for USDP ā DAI swaps
Raised fees for DAI ā USDP swaps
On the bright side, Maker saw a big bump in fees from PSM usage:
Two things strike me about MakerDAOās response. First, Maker is integrated with a lot of the DeFi ecosystem. Not only were they arguably over-exposed to USDC, but they had vaults with USDC LP positions as collateral and deep integrations with Compound and Aave via the D3M module.
Remember, Compound v2 has a fixed $1 price for USDC and a single pool of USDC. If USDC fell below the peg for long, users could supply USDC valued at <$1 and get $1 of DAI in return. This could lead to an accumulation of bad debt, that the D3M system has no idea about. While Aave v2 doesnāt have the same risks (they use an oracle to calculate price), Maker opted to shut it down in an abundance of caution.
Now, Maker is going to use $750 million USDC to purchase money market assets like treasuries and other fixed rate securities. Maker wants to control its own destiny when it comes to custody risk and go directly to the source, hedging against USDC. Inching away from DeFi, Maker is continuing to make inroads towards the traditional financial system.
Second, these changes were proposed on the Saturday March 11th, one day after the SVB closure, in the middle of price volatility. Depending on your perspective, this was a fast response by a relatively small team or a slow response due to governance procedures.
Is decentralized governance agile enough to respond to the fastest bank run in history? In this case, the Risk Core Unit doesnāt think so. Later, they would propose an emergency āPSM Breakerā to halt PSM activity without governance delays. Note that MakerDAO is in many respects the gold standard for decentralized governance. It utilizes small teams with very specific responsibilities as a way to move quickly and efficiently.Ā
Can smart contracts be designed well enough to withstand the maelstroms of the digital age? An age where a $42 billion bank run can happen in 24 hours? Or will we need to rely on humans to do the dirty work of adjusting?
Final thoughts
While the idealized DeFi protocol has minimal human intervention, realistically, humans are still at the core of crypto. The protocols rise and move because humans will it. And while ādonāt trust, verifyā is, and should be, the motto of our industry, we also have to be aware who controls the protocols where we put our money: forthright and competent actors or not. DeFi is always live, so protocols and teams have to be too.
Collapse happens gradually, then suddenly. Silicon Valley founders and VCs learned that the hard way. There is real risk in who youāre banking with, and while the federal government has ensured all deposits, this just means that the federal government is now on the hook. But donāt worry, everything will be fineā¦
Ā Wait a minute... That sounds familiarā¦
Over the last 2 years, many people got lost in the jpegs, pump-and-dump schemes and the web of lies spun bad actors, but the foundation of crypto has always been economic freedom. That is why we stay. For many, our economic freedom, more than ever, is not in our controlābut now we have a new path forward.
Action Steps
šĀ Read The Demise of Silicon Valley Bank | Marc Rubinstein
āļøĀ DigĀ into The Stablecoin Edition | DeFi Download
š§Ā Listen Balaji Bets the Dollar will Hyperinflate | Bankless Shows
š§Ā Listen Arthur Hayes Says, āGet your Bitcoin, and Get Out!ā | Bankless Shows
GMX
By: Austin Foss
Under the larger synthetic asset umbrella is another subclass of assets called derivatives.
Among the many early DeFi projects dYdX made derivatives their niche and in 2019 had reached 150,000 ETH of TVL. Almost a year later they announced a partnership with Starkware to help scale up dYdX transactions and settlement times using Starkwareās brand new zk-rollup tech, launching the DEX in April 2021. According to charts from DeFi Llama, dYdX peaked with a TVL worth over 1 billion USD.
Another year later, dYdX announced their plans to migrate to their own dYdX Chain built using the Cosmos SDK and plans "to be a leader in the Cosmos ecosystem..." Unfortunately it seems this news may not have been received well because around the same time dYdX's TVL dropped sharply. However, this was also at the start of the deepest lows of last year's bear market. Still,Ā they have not yet managed to reverse that downward trend; today they have about 340 million USD worth of TVL.
Enter GMX; according to DeFi Llama, the top competitor in their derivatives category for DeFi protocols with more than 580 million USD worth of TVL; and while it did experience a dip around the same time dYdX did, GMX managed to maintain a steady upward trend through the rest of 2022 to today and has overtaken dYdX's head start in the market.
Derivatives
First, letās define derivatives with the context of DeFi. Vanilla DeFi, such as AMMās like Uniswap, donāt have ability to perform advanced trading actions, but with the power of derivatives features like limit orders and margin trading can be enabled natively without compromising on decentralization by having to use a CEX or an alternate L1.
Derivatives are generally defined as:
"... contracts with values derived from underlying assets... Although the derivative's value is based on an underlying asset, a contractās owner doesnāt necessarily own the underlying asset. - Hedera"
This sub-class of assets has two further categories called "... lock and option derivatives."
An option derivative allows the owner of the contract to purchase an asset at a given price at any time before the option expires. This allows for limit orders; if you wanted to buy ETH but only when it reaches a price of 1500 USD for example.
Lock derivatives bind the owner to an obligation where they must purchase the asset at some point in the future. This enables futures trading: holding a long position if you think the price will go up or a short position if you think the price will go down. Modified lock derivatives called perpetual contracts allow traders to keep positions open perpetually as long as their collateral ratio doesn't fall within liquidation range.
How it Started, How it's Going
Originally launched under the project name Gambit in early 2021 on the BSC Chain the project brought a new stable coin to DeFi, USDG, to act as fee rewards for their DEX. Over several months, the project organically evolved, eventually migrating to a simple liquidity provider token, GLP.
GMX was obtained by migrating the other legacy tokens Gambit used. This consolidated several tokens into just a few and removed the headache of needing to maintain a stablecoin peg.
On Sept 14, 2021, a few months after GMX deployed to Arbitrum, GMX announced they had obtained the GMX.io domain, allowing the completion of the migration from Gambit. Four months after that, GMX launched on Avalanche.
Following the migration, this left the protocol with a GMX token supply distribution as follows:
6 million GMX from the XVIX and Gambit migration.
2 million GMX paired with ETH for liquidity on Uniswap.
2 million GMX reserved for vesting from Escrowed GMX rewards.
2 million GMX tokens to be managed by the floor price fund.
1 million GMX tokens reserved for marketing, partnerships and community developers. 250,000 GMX tokens distributed to contributors linearly over 2 years.
In the first two weeks of September, 2021:
~$150 million has been traded on GMX
~$300,000 in fees have been earned by the protocol, including Gambit fees
~$900,000 added to the floor price fund
Since then, looking at a Dune Analytics dashboard created by gmxtrader, GMX has done more than 112 billion USD of volume, and more than 170 million in fees, from more than 172,000 unique users.
Current daily volume is at about 62 million USD from 670 unique traders and the total assets under management (AUM) in the vault has grown to ~600 million USD. Earlier in the year dYdX had migrated to Starkwareās StarkEx platform, using a zk-rollup which one might think would give them a head start, while GMX opted to migrate from BSC to an Ethereum native optimistic-rollup just a few months later.
It wouldnāt be until a year after launching on Arbitrum that GMX surpassed dYdXās TVL, breaking through the 400k USD milestone, once dYdX announced their intent to move to Cosmos and their own app-chain.
Audits
GMX has undergone two audits in its history. One done by ABDK Consulting conducted in April, 2021 and another by Quantstamp on September 14, 2022.
In the most recent audit, a vulnerability titled "Ability to Rug-Pull" stands out at the top of the list. Its description reports that the admin of one of the protocol contracts is capable of conducting a rug-pull of the protocol's Vault.sol contract. It was marked only as moderate because there would be time, 1-5 days but likely just 1 day, where users could close all positions and exit before getting rugged.
In partnership with Immunefi there is a bug bounty program available with rewards of up to 5 million USD for critical smart contract bugs.
Up Only?
Bucking the bear trend in the market throughout all of last year ā TVL is up, token price is up ā GMX certainly stands out from the rest of the DeFi protocols as TVLs across the whole ecosystem are trending in the opposite direction, and has become the dominant Ethereum native protocol operating in the derivatives niche.
That's not to say this is a one-size-fits-all or meant to be a ringing endorsement of the project; especially with the admin vulnerability mentioned in the second audit. Margin trading is not for everyone and is one of the easiest ways to lose your shirt trading. Only put in what you can afford to lose.
Congratulations to the GMX team for managing to build such a successful project during the bear market and experiencing continued organic user adoption.
Project Releases š
Hand-picked updates to help you understand the current state of the DeFi ecosystem
Coinbase Wallet as a Service
Allow companies to integrate crypto directly into their applications
Use Coinbase infrastructure to automate wallet creation, access, and restoration without seed phrases
Uses advanced multi-party computation
Ā
TornadoCash Privacy Pools Demo
TornadoCash is still live, just sanctioned
Privacy Pools allows users to prove that theyāre not part of a subset of depositors (i.e. hackers)
This is still a demo and is not auditedāuse with caution
Uniswap Launches Wallet
Limited early release of mobile app on Optimism, Polygon, Arbitrium
Uniswap is moving up the stack to eventually become a fiat ramp
Watch token and wallet address activity
Uniswap is being held up by Apple
RocketPool Atlas Upgrade
Allow withdrawals upon Shanghai Upgrade
Lower ETH bond minimums to 8 ETH (3x capacity, 42% improvement over solo staking and 25% improvement over 16 ETH minipools)
Solo stakers can become rocketpool minipools without exiting the staking pool
Arbitrum $ARB Airdrop, DAO, and L3 solution Launched
The $ARB token will be used for DAO governance
~56% will go to the community distributed in the airdrop Thursday, March 23, based on snapshot from Feb 6, 2023
Created a 12-member āArbitrum Security Councilā to take emergency action
Arbitrum Orbit allows developers to launch Layer 3 blockchain on Arbitrum
Rollups on Bitcoin
Uses Bitcoin as a data availability layer for the Rollkit EVM rollup
Creates a fee market on Bitcoin to increase the security budget
Uses Taproot transactions
Ethereum Shanghai Date announced
Aztec to sunset privacy solution Aztec Connect
Refocusing on Noir programming language to build privacy focused ZK-Rollup
Deposits are disabled
Withdraw funds from zk.money by March 21st, 2024
Uniswap launches on BNB
Chirping Birds
š„ and š§ tweets from across the DeFi ecosystem
Security Scares: Go Hack Yourself
Author: Austin Foss
Almost exactly a year after 120k ETH was stolen via the Wormhole Bridge exploit, the hack took second place in 2022's record-setting year for DeFi hacks, more ETH than was initially stolen has been recovered.
From their own blog Oasis announced that on February 21, 2022:
"... received an order from the High Court of England and Wales to take all necessary steps that would result in the retrieval of certain assets involved with the wallet address associated with the Wormhole Exploit on the 2nd February 2022." - Oasis
Chainalysis created a detailed illustration of the hacked funds movements over the last year in their larger report on the incident.
An update on January 30, 2023 was added to the report stating that 95k ETH was traded for stETH which was used to borrow DAI using the Maker protocol, which was subsequently used to purchase more collateral and borrow even more DAI, effectively leveraging up their position.
This decision by the attacker proved fatal; not for themselves as they are still at large, but for their profits.
Oasis' Self Exploit
In a report published on February 24 by Blockworks Research titled Jump Executes Counter Exploit Against Wormhole Exploiter, analyst Dan Smith details how the "120.69k wstETH and 3.21k rETH ($225M of assets)" were recovered.
When "The Exploiter added a stop-loss trigger to vault 30100 just 9 minutes after opening the vault..." the game was over.
Stop-loss or other automation controls available to manage Maker vaults, provided by both Oasis and DeFi Saver, are automated through bot contracts. Oasis launched automation of their vaults in July 2022 and while they do report having an audit conducted on their "Multiply Contracts" by Chain Security this was done almost a year prior in September 2021.
Perhaps if an audit had been done the hacker would have known ahead of time not to make use of the very helpful automation features, but unfortunately for them, knowingly or not, Oasis had left a backdoor open to any vault using the same bot contracts.
Relevant Addresses
Dan Smith identified five addresses used in the recovery process:
Oasis Multisig (0x85): A 4 of 12 multisig that owns the Oasis proxy contracts.
Holder (0x5f): Currently holds the recovered funds and appears to be owned by Jump.
Sender (0x04): Responsible for executing the counter exploit and appears to be owned by Jump.
Jump1 (0xf8): Funded the Sender with DAI to repay the debt and recover the collateral...
Jump2 (0xf5): Received leftover DAI from the Sender. Commonly labeled āJump Trading,ā...
Recovery Procedure
Sender is added to the Oasis Multsig
Sender upgrades the automation proxy contract
Sender uses the new proxy to move both the attacker's collateral and debt out of their control
There's more nuance to exactly how this played out, so for full details make sure to read Dan's full report.
Jump?
Jump Crypto is involved in this story because, according to Blockworks, they are "the crypto arm of Jump Trading, which was involved in the development of the Wormhole protocol."
CIO of Jump Trading, Dan Olsen, is quoted a month after the initial hack happened to have said that "this is not something that we will become distracted by next month or next year ā this is a permanent condition."
Is this Victory?
While Jump could have been motivated purely by recovering funds they had put up to make users whole a year ago:
Counter-exploiting the attacker by taking over a user's vault by way of upgradable contracts raised eyebrows from across the crypto-ecosystem. Could this be called a white-hat move?
But if Oasis or another signer on the Oasis multisig could do that to the Wormhole hacker, could they do the same to them? Concern from average Maker protocol and Oasis users over the security of their own vaults was great enough that a lengthy response from the Oasis CEO was made:
Implications & Precedents
Ultimately, this story, while may raise mixed feelings among some DeFi users, was an eye-opening event around the risks of upgradable contracts.
It also brought to light the possibility for multisigs to be served a court order if the members are known to the public. In a followup editorial also published by Blockworks:
āThe nuance here is that a few days before all of this happened, what they described as a white [hat] group came to [Oasis] and identified a [previous] āvulnerabilityā within this multisig proxy contract... And once that was realized by them, and apparently realized by the court as well, the opportunity for unilateral action by this multisig was actually possible, and thatās what the court appears to have enforced.ā - Joe Coll, Blockworks/Framework Ventures
BANK utility (BanklessDAO token)
With overĀ 5,000 holders, BANK is one of the most widely held social tokens in crypto. So it bears asking, where are the best places to put our BANK to use? The five protocols below will allow you to deposit BANK in a liquidity pool and earn rewards. To get going, just click on the name, connect to the app, filter by BANK, and start earning passive income.
āļøĀ Balancer
Balancer has two 80/20 liquidity pools, meaning that you are required to deposit 80% BANK and 20% ETH in the pool. There is one pool on Ethereum and another on Polygon. Once youāve provided liquidity, youāll receive LP tokens. Keep an eye out for opportunities to stake these LP tokens. There is nearly 500,000 USD in the two Balancer liquidity pools.
š£Ā SushiSwap
SushiSwap has a 50/50 BANK/ETH pool. As with Balancer, you will receive LP tokens, and while you canāt stake them on SushiSwapās Onsen Farm yet, you may be able to in the future. Liquidity providers earn a .25% fee on all trades proportional to their pool share. The SushiSwap pool has a little over 100,000 USD in liquidity.
āĀ Rari Fuse PoolDeprecated Soon
This will be deprecated soon.Ā The Rari Fuse Pool allows you to borrow against your BANK or earn huge APY by providing assets like DAI to the pool. At present, all borrowing is paused for this pool. There is over 450,000 USD deposited in the Pool
š¦Ā Uniswap
The Uniswap V3 liquidity pool is 50/50 BANK/ETH, and provides a price oracle for the Rari Fuse Pool. By depositing in the Uniswap pool, you can earn fees and help enable borrowing on Rari. This pool currently has over 500,000 USD in liquidity.
šŖĀ Arrakis
You can also provide liquidity to the Arrakis Uniswap V3 pool. The ratio is about 2/1 BANK/ETH. This pool is new, and only has a bit more than $6,000 in liquidity. In the future, you may be able to stake your BANK/ETH LP tokens within the protocol to earn additional rewards.