Connect with us
DAPA Banner

Crypto World

Resolv hack shows DeFi learned nothing from last contagion

Published

on

Resolv hack shows DeFi learned nothing from last contagion

Sunday’s $23 million hack of Resolv’s stablecoin USR has led to contagion across the DeFi sector.

Opportunistic traders used depegged USR to borrow against, draining liquidity in over a dozen yield vaults.

To make things worse, so-called “risk curators” then automatically allocated more funds to broken markets as lending rates spiked.

In November, a similar contagion hit DeFi’s “curated” vault ecosystem after Stream Finance announced a $93 million loss, leading to a 75% of xUSD.

Advertisement

Despite discussions of risk ratings and curators putting up first-loss capital in the aftermath, it appears not much was learned, after all.

Read more: Four months on, MEV Capital falls victim to $4B DeFi daisy chain implosion

The hack

Resolv Labs’ statement confirmed that a private key compromise led to the unauthorized (and unrestricted) “minting of approximately $80 million of uncollateralized USR.”

USR’s pre-hack token supply remains fully backed, with losses coming from liquidity providers (LPs) on decentralized exchanges as the hacker sold the minted tokens. For example, LPs on Curve Finance alone are estimated to have lost $17 million.

Advertisement

The hacker’s sell-off caused a depeg of USR, which is currently trading at $0.23, according to CoinMarketCap data. Blockchain security firm Beosin puts the attacker’s profits at 11,409 ether (ETH), worth over $23 million at the time of writing.

The Resolv team faced criticism for a slow response time while collecting the necessary multisig signatures to pause the protocol.

It has contacted the exploiter on-chain, requesting return of 90% of the converted ETH, as well as the remaining USR.

Read more: Venus Protocol hacker lost $4.7M after nine months of planning

Advertisement

The fallout

The hack may have been simple, but the knock-on effects have been anything but.

Depegged USR was pounced upon by opportunistic traders who used it to drain yield vaults with hardcoded price oracles. In buying cheap USR to use as collateral, users could borrow other assets, such as USDC, as if USR were still worth $1.

Read more: Oracle error adds to turmoil at DeFi giant Aave

As if things weren’t bad enough, “risk curators” automated strategies then allocated further funds to the affected markets, whose high utilization had spiked supply yields.

Chaos Labs’ Omer Goldberg explained how Morpho’s Public Allocator feature allowed curators “including Gauntlet, re7, kpk, and 9summits” to autoallocate millions of dollars worth of assets into markets “based on pre-configured and approved caps and credit lines.” 

Advertisement

In some cases, Goldberg says, allocation into broken vaults continued for hours.

The chaos also brought innovation, however, as the auto-allocations were even specifically targeted to free up additional liquidity. Enterprising competitors Obsidian also capitalized on the incident, offering a migration service to users whose deposits are stuck in illiquid Morpho vaults

Assessing the damage

Morpho’s Paul Frambot tallied 15 affected vaults with over $10,000 of exposure to USR.

According to security researcher Weilin Li, curators of the affected vaults, on Morpho and elsewhere, include Gauntlet, Re7, MEV Capital, Extrafi, Seamless, August, Clearstar, kpk, Leyrock and 9Summits. 

Advertisement

For those who followed November’s collapse, many of these names may be familiar.

Yearn, whose contributors were amongst the harshest critics of the yield vaults which led to November’s crash, suffered a minimal loss of $377.

Ironically (or tellingly), Resolv’s own risk manager, Steakhouse, wasn’t exposed to USR, despite stating that “operationally, Resolv demonstrates institutional rigor” just five days before the hack.

The backing of Inverse Finance’s DOLA stablecoin was indirectly exposed to the depeg of USR, with the team pledging to patch the $340,000 hole.

Advertisement

A number of lending markets paused USR markets, including Venus Protocol, which was itself hacked last weekend, and Lista

Fluid was the worst hit, and may have accrued up to $17.5 million of bad debt. However, the team reassured users that it had “secured short-term loans to cover 100% of the bad debt.”

It also considers selling FLUID tokens “should any additional funds be required.”

Following a dicey few months for top dog lending protocol Aave, with governance drama and an oracle mishap, Aave Labs’ Stani Kulechov was keen to highlight Aave’s lack of exposure.

Advertisement

DeFi daisy chain

The web of platforms affected by the compromise of a single private key is a stark reminder of how one of DeFi’s key innovations, interoperability, is a double-edged sword.

Automated allocation may optimize returns under normal conditions, but when things break, which they often do in DeFi, unintended behavior follows.

Without their own funds in play, the current setup incentivises “malicious game theory pushing [curators] to seek more risk.”

This latest episode has renewed calls for curators to have skin in the game. One approach is tranching of deposits, with curators set to lose out first should their risk be improperly “curated.”

Advertisement

Got a tip? Send us an email securely via Protos Leaks. For more informed news, follow us on XBluesky, and Google News, or subscribe to our YouTube channel.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Kalshi Joins Polymarket in Insider Trading Bans

Published

on

Bills, Polymarket, Kalshi, Prediction Markets

Two major prediction market platforms, Kalshi and Polymarket, on Monday announced new trading guardrails to address insider trading amid mounting concerns of market manipulation on recent event contracts. 

It comes the same day that US lawmakers introduced a bipartisan bill to ban event contracts that resemble a “sports bet” or “casino-style game.”

Kalshi on Monday said it would preemptively ban political candidates from trading on their own campaigns and those known to be involved in college and professional sports, such as athletes, personnel, and referees.

Kalshi’s ban followed just hours after rival Polymarket revealed comparatively broader prohibitions to ban users who trade using stolen confidential information, illegal tips or those who can influence the outcome of a market.

Advertisement

The platforms have faced mounting criticism over insider trading after Polymarket users profited from well-timed bets before US and Israeli strikes on Iran and a US military operation to capture Venezuelan President Nicolás Maduro.

Ben Yorke, a former Cointelegraph research analyst, told The Guardian on Monday that the Iran strike bets were “someone with some degree of inside info,” as the bets were made at market price, and multiple accounts were used in an apparent attempt to obfuscate their identity.

Kalshi said its ban has “been in the works for months” and was made to proactively address regulatory guidance and legislation introduced in Congress involving insider trading and market manipulation on prediction markets.

Bills, Polymarket, Kalshi, Prediction Markets
Source: Robert DeNault

Bipartisan bill would ban sports event contracts

Kalshi and Polymarket’s bans come after Democratic Senator Adam Schiff and Republican Senator John Curtis introduced a bill on Monday to ban certain event contracts “that are indistinguishable from gambling.”

The so-called Prediction Markets Are Gambling Act would ban Commodity Futures Trading Commission-registered entities, which would include Kalshi and Polymarket US, from listing event contracts that resemble “a sports bet or a casino-style game.”

Advertisement

“Sports prediction contracts are sports bets — just with a different name,” Schiff said. “These contracts have been offered in all fifty states in clear violation of state and federal law.”

Curtis said that the legislation “clarifies regulatory jurisdiction, ensuring that states can maintain their authority over sports betting and casino gaming.”

Related: US Senate bill targets prediction markets on war and assassinations

Tarek Mansour, the CEO of Kalshi, which is a member of the Coalition for Prediction Markets lobby group, posted to X that the bill was the “casino lobby hard at work.”

Advertisement

“This bill isn’t about protecting consumers; it’s about protecting monopolies,” he added.

Prediction market platforms, including Kalshi, Polymarket and Coinbase, are embroiled in legal action across multiple states, which have asserted that sports event contracts are gambling that requires a state license to offer.

The platforms have argued that their contracts are not illegal betting and are, regardless, subject to the exclusive jurisdiction of the CFTC, not state authorities.

Magazine: When privacy and AML laws conflict — Crypto projects’ impossible choice

Advertisement