On July 30th, Beijing time, some versions of the intelligent programming language Vyper were found to have serious vulnerabilities, and some important projects including Curve Finance were attacked as a result.
According to the Curve team, because some pools (alETH, msETH, pETH) used Vyper's version 0.2.15 language, the reentry lock function failed, allowing attackers to execute certain functions multiple times in a single transaction, resulting in certain financial losses.
As for the specific amount of loss, Paidun earlier calculated that the total loss including Alchemix (alETH issuer), JPEG'd (pETH issuer), Metronome (msETH issuer), deBridge, Ellipsis, Curve CRV-ETH pool, etc. was approximately 52 million US dollars.
Under extreme circumstances, as CRV's on-chain liquidity reserves failed to effectively bear the concentrated selling pressure, CRV's trading prices on multiple DEXs fluctuated violently this morning. Between 3:05 and 3:15, the instantaneous price of the CRV/WETH trading pair on Uniswap was almost zero, and at one point fell to around US$0.08 (now recovered to around US$0.62).
Fortunately, this extreme instantaneous price was not reported by the Chainlink oracle. According to Chainlink's price feed data history, due to the use of the weighted quotation logic of "CEXs + DEXs", the lowest price reported by the oracle at the same time point was $0.59. As the most commonly used oracle service in the industry, this "small" quotation difference may have helped Curve, Aave and even the entire DeFi industry avoid a greater disaster.
We can imagine what DeFi would look like this morning if Chainlink had reported 0.08 instead of 0.59.
The first thing that is certain is that CRV-collateralized debt positions on a large number of lending protocols, including Aave, will face direct liquidation risks.
Take the position of Curve founder Michael Egorov as an example. He has pledged a total of 292 million CRV (about $181 million) on Aave, FRAXlend, Abracadabr, and Inverse, and borrowed $110 million. The comprehensive liquidation price is around $0.4. If Chainlink quotes a price of $0.08, there is no doubt that these positions will be liquidated immediately.
In this case, many users, including Michael Egorov, will face financial losses. Considering that the on-chain CRV liquidity capacity was already insufficient at the time, these liquidations would be difficult to execute effectively, posing a potential bad debt threat to lending protocols such as Aave and FRAXlend (CRV is almost zero, and the money from liquidation sales is unlikely to cover the debt).
As the liquidation progresses, CRV will continue to face greater selling pressure, which may exacerbate the panic in the community (don’t forget that the founder will also be liquidated at that time), leading to a more serious situation.
Overnight, several cornerstones of the DeFi world were hit hard, which is bound to have huge collateral effects. It is hard to imagine what the industry would look like when we woke up this morning if this really happened.
In the community discussion, some people compared Chainlink’s quotation operation this morning to BitMEX’s “pulling the plug” on March 12. As the industry’s largest contract exchange by trading volume in 2020, BitMEX was down for an hour and a half during the extreme market conditions on March 12, but it indirectly prevented the market from further plummeting, and was therefore jokingly called by many people as “saving the industry.”
Objectively speaking, Chainlink’s situation is different from BitMEX. It is just executing its own “CEXs + DEXs” weighted quotation logic normally. Although some users believe that using CEXs as one of the quotation sources is less decentralized in the DeFi world, based on the current market conditions, CEXs still have more comprehensive and stable quotations than DEXs (especially for altcoins). At least this time, the quotations from CEXs may have saved the industry.