Intro
On the 30th of July, a vulnerability was reported in Vyper, the programming language that Curve’s contracts are written in. This only affected an older version of the code, however there were still some Curve pools that were deployed with the vulnerable code more than a year prior and were still actively used. The largest alETH pool was one of these pools.
A hacker quickly took action and exploited the vulnerability, which led to a devastating loss to alETH liquidity providers, including Alchemix itself.
A week later, the funds taken by the hacker were returned, but the exploit caused additional damage. Discussions are still ongoing to figure out the best way to reimburse the affected parties. A Curve Exploit Post Mortem was released on Alchemix’s Medium.
Most of the focus of the core team has been on handling the fallout, but in the meantime, normal operations have resumed for the most part.
So dive in to this edition to see what else is going on in the world of Alchemix!
Protocol Statistics
We also have an additional fun fact - since the inception of gALCX, over 39,786 ALCX have been automatically compounded for gALCX holders!
News & Announcements
The Curve Hack
On the 30th of July, the Alchemix team and the public were notified that a vulnerability was found that affected the alETH-ETH Curve pool and were advised to remove all funds. For the Alchemix protocol itself this meant ~13k ETH worth of liquidity at risk. The Multisig team promptly assembled and started to remove the funds.
For technical reasons, this could not be done in a single transaction. The Multisig team managed to remove 8k ETH worth of liquidity before the pool got exploited.
This meant that 5k ETH of the protocol’s own funds and 11k ETH of other liquidity providers’ funds were stolen.
A full post mortem was published on Alchemix’s Medium and you can find additional details scrolling down in the Newsletter.
Hacker Returns Funds
A week after the exploit and through communications with the hacker, they returned all the funds that they took from the pool.
Unfortunately, the way the hacker carried out the exploit, it left almost 4k ETH up for grabs for the fastest arbitrage bot to scoop up for a few dollars.
These funds were then disseminated across all mainnet alETH pools through hundreds of trades, mainly by automated arbitrage bots.
So even though the hacker returned everything they initially took out, it still caused a further 4k ETH worth of damage to liquidity providers, most of which is now impossible to reclaim.
Additional Returns and Post Mortem
As the arbitrage bots and users with manual trades following the exploit were able to generate profits that under no circumstances can be called normal market operations, and it was at the expense of the exploited liquidity providers, the Alchemix team started to reach out to the operators of all addresses to ask them to return their profit.
Thankfully, some of the operators understood what had happened and returned the profits they made. There are still ongoing discussions with MEV bot operators and validators to respectfully ask them to do the right thing.
Also, a group of people tried to bridge alETH from mainnet to Optimism following the hack. The bridge got deactivated shortly after the exploit to avoid having the hacker bridge their stolen alETH to Optimism and cause further damage.
However, this meant that the assets of the bridgers got blackholed.
As a large portion of the funds stuck on the bridge were essentially stolen funds, a DAO vote was held to determine how to reimburse bridgers. The decision was made to allow bridgers to keep a small percentage of their profits, but use the majority of the stolen funds and later return them to their rightful owners.
This still leaves a large portion of the 4k ETH unaccounted for. There are ongoing discussions with Curve to explore possible reimbursement options.
Coinbase keeping stolen funds
In the block following the exploit transaction, an arbitrage bot cleaned out the remaining 3854 alETH in the pool. In order for it to be the first, it had to pay an insane 570 ETH as tip to the validator of that specific block for its transaction to be included in the block. This validator happened to be Coinbase. This meant that while the arbitrage bot made 614 ETH on the transaction, with the tip that it paid Coinbase it actually only made a ~43 ETH profit. The operator of the bot returned their profit after the Alchemix team reached out.
Coinbase, however, is unwilling to co-operate at the moment and is insisting on keeping the profit they made, which is the second largest tip ever paid to a validator in a single transaction in the history of the Ethereum blockchain.
CoinDesk has also released an article that outlines the events.
alETH Vaults Reopen
Some functions of the alETH Alchemist were deactivated after the exploit to allow for enough time to understand what had happened and how it affects the overall system. This meant that only repayments with alETH and withdrawals in the form of the yield token were available.
After careful consideration, it was deemed safe to re-enable all functions of the Alchemist, though the Transmuter remains inactive and all repayments, self-liquidations and yield-flow from the Alchemist that would go to the Transmuter have been re-directed to the alETH Elixir AMO.
Shall We Connext?
After the Multichain shutdown, it was obvious that a better bridging solution needed to be found that had no extreme centralization factors and where one could be reasonably certain that the bridge will remain operational.
Following discussions with multiple bridge providers, Connext’s solution was chosen. It was deemed to be the most secure out of the available options and Alchemix is happy to be one of the first adopters of the xERC20 standard!
The alUSD bridge is now operational!
Connext Airdrop
If you used Alchemix before, make sure you check out the link in the tweet to see if you qualify for Connext’s airdrop. Alchemix users are also getting a boost!
A New Quarter, A New Report
As is now customary, we have released our Q2 2023 Financial Report.
Dig in to learn more about what makes Alchemix tick and how well the protocol performed. The full report is available for download in the Alchemix GitBook and the summary on Medium.
Alchemix Use-Cases
Have you always wondered what you can use Alchemix for? Wonder no more, the tweet thread (“x” thread?) below has you covered.
Restoring alUSD
The Multichain collapse left alUSD on Optimism and Arbitrum partially unbacked. AIP-95a passed and the necessary transactions have been executed to remedy the situation. All alUSD on all chains is now fully backed.
Archimedes
The team at Archimedes did the math and added the alUSD-FRAXBP Curve pool as a deployment option for their stablecoin strategies. They provide additional features on top of a simple deployment.
ICYMI
Catch up on all the governance updates and new articles since the last edition.
AIP-95a Multichain Response - Optimism and Arbitrum
AIP-95b Multichain Response - Fantom
Results of AIP-92 - Alchemix L2 Bridging Update / Fantom Wind-Down
Results of AIP-93 - Investment in Curvance
AIP-95b Multichain Response - Fantom [REVOTE]
AIP-96 Stuck alETH Bridger Resolution
AIP-97 Resume alETH Alchemist, re-direct ETH backing to AMO
Results of AIP-95a - Multichain Response - Optimism and Arbitrum
AIP-98 Multi-Tenant veDAO Launchpad
Results of AIP-95b - Multichain Response - Fantom [REVOTE]
Results of AIP-96 - Stuck alETH Bridger Resolution
Results of AIP-97 - Resume alETH Alchemist, re-direct ETH backing to AMO
Community & Media
Mosaic
Mosaic has been deployed in the Alchemix Discord server. Mosaic is an inter-server communication solution on Discord, where questions asked on one server are also visible on other integrated servers, where users can answer the question and interact with each other.
Check out the #mosaic-portal channel in the Alchemix Discord!
Arbitrum Spaces
As Alchemix decided to deploy on Arbitrum, Scoopy was invited to take part in an AMA to talk about the details and introduce Alchemix to the Arbitrum community.
Alchemix Deep Dive
It is not often that we see a deep dive about the protocol that is so well researched. There are some missing details, but the video covers the main questions that investors should consider before buying the ALCX token.
Check it out!
Rare Network podcast
Ov3rkoalafied appeared on the Rare Network podcast ahead of the Rare Evo event to introduce Alchemix to a non-DeFi-native crowd.
Should You Bribe?
Koala strikes again in a Twitter spaces conversation, organized by Gelato. Together with North from RAMSES they touch on the intricacies of bribing and the base mechanics of DEXes.
Curvance
As per AIP-93 Alchemix became a seed investor in Curvance. They published a nice summary of Alchemix and how Curvance can help further the goals of our protocol.
They will be launching soon.
Resources
Stay safe online! When using Alchemix, always be sure that you are interacting with the official resources:
Website: https://alchemix.fi
Twitter: @AlchemixFi
Discord: https://discord.gg/alchemix
Medium: https://alchemixfi.medium.com
Disclaimer
This Newsletter is provided for informational purposes only and does not constitute any kind of advice. Use cryptocurrencies and Decentralized Finance (DeFi) at your own risk.
Thanks for reading the Alchemix Newsletter! Subscribe for free to receive updates to your inbox.