This article reviews Curve Finance's "governance attack" incident by the USDM team

Odaily资深作者

2021-11-12 15:39 (UTC+8)

This article is about 1498 words, reading the full article takes about 3 minutes

In this attack, Mochi used the governance vulnerabilities of its own protocol, Curve, and Curve's revenue aggregator Convex to complete this "governance attack."

AI Summary

Expand

In this attack, Mochi used the governance vulnerabilities of its own protocol, Curve, and Curve's revenue aggregator Convex to complete this "governance attack."

Author: Chen Zou

On Thursday, Charlie_eth, a core member of the Curve Emergency Management Committee (Curve Emergency DAO), published a post. The abnormal fluctuation of CVX price caught the attention of the DAO, and finally found that it was a "governance attack" initiated by the USDM stablecoin protocol Mochi protocol. .

According to Mochi's official white paper, the project is a self-managed decentralized stable currency protocol, which still uses over-collateralization (collateral value > loan asset value), which can realize mortgage assets without threshold and based on specific conditions listed. Mochi users can mint USDM stablecoins against listed collateral through the Mochi Vault smart contract.

In this attack, Mochi used the governance vulnerabilities of its own protocol, Curve, and Curve's revenue aggregator Convex to complete this "governance attack."

picture

To understand why the Mochi project has spent so much effort to transfer all assets to CVX, you need to understand the role of CVX.

Convex Finance is a "CRV staking and liquidity mining one-stop platform" dedicated to simplifying the use of Curve. It is a revenue aggregator on the Ethereum chain, and CVX is its governance token on the chain. The token can be used to vote on proposals to increase the remuneration of CRV holders and liquidity providers. It was originally suitable for promoting the development of the CRV ecosystem, but here it became a tool for Mochi to complete the "governance attack".

Next, the Mochi project party used a large amount of CVX to vote, and successfully increased the rate of return of the liquidity mining pool (the distribution of CRV rewards), thereby attracting more liquidity providers to participate until the pool reaches After the liquidity of 100 million US dollars, the project team felt that it was time to harvest, so they chose to exchange Mochi for USDM, and finally exchanged for DAI, and cashed out directly. It is estimated that about 46M USDM was eventually exchanged for DAI, about 3000 Ten thousand U.S. dollars. This is only the income of the project side. Considering the large amount of transaction fees, slippage and other losses, the loss of miners may be far greater than this value. According to relevant sources, a domestic Chinese investor "mining penguin" lost nearly 5 million US dollars in the harvest.

The emergence of Curve has solved the anchor point and slippage problems of stablecoins, and various stablecoins have emerged. Curve adjusts its weight once a week. The locked veCRV determines the liquidity of CRV. Most of the CRV in the market are locked , and the average lock-up time is greater than 3 years, and Convex controls about 40% of veCRV. From these data, in fact, most of the liquidity income of CRV is given to Convex, so CRV shares can be obtained through Convex. Curve’s design of three tokens in one agreement and the income plan are more complicated. Convex allows users to pledge, Claiming CRV, although Convex is only a vertical asset management agreement for Curve, the locked-up amount of veCRV pledged on Convex far exceeds that of yEarn.

As a solution to remedy the situation, Curve Finance has completely closed the USDM gauge, making it immediately stop receiving CRV output, avoiding a wider range of losses.

Yearn Finance founder Andre Cronje calls it"amazing scam"。