DeFi's Contagion Curveball

Dear Bankless Nation,

Just when things seemed to be quieting down in crypto...

Yesterday, a nightmare exploit left hackers running away with tens of millions in crypto, but it's the second- and third-order effects of the theft that are leaving industry veterans frightened. What happens next could spell disaster for some of DeFi's largest lending protocols.

- Bankless team

Just a couple of weeks ago, Curve Finance founder Michael Egorov spoke too soon.

Early on Sunday, Vyper, a “pythonic smart contract language” and compiler for EVM applications, revealed that multiple versions of its compiler did not correctly implement the reentrancy lock. Multiple protocols were compromised yesterday as a result of this zero-day vulnerability and DeFi darling Curve was among the victims.

Nearly $70 million is estimated to have been displaced during the fiasco. While a meaningful percentage was taken by whitehat hackers and altruistic MEV bots (like c0ffeebabe.eth) and is recoverable, the exploiters sadly managed to walk away with a majority of the funds…

The curtains may have closed on the first chapter of this exploit, but it looks increasingly plausible that this fiasco is just beginning… DeFi may be on the brink of a major contagion event!

Numerous protocols accept Curve Finance (CRV) tokens as collateral, a perk fully utilized by Egorov, who took out $110 million in stablecoins loans across numerous protocols collateralized by 460M Curve Finance governance tokens (CRV), worth approximately $290M at current market prices.

The largest of the outstanding loans (nearly $70M) is collateralized by a whopping 34% of the circulating CRV supply. The loan is from Aave V2 and has a liquidation price of $0.376 per CRV. Should the exploiter attempt to swap out of their 7M stolen CRV tokens (8% of the circulating supply), the price would very likely fall below Egorov’s liquidation point for a sustained period of time, forcing the closure of his positions and exposing lenders to the possibility of bad debt during the liquidation process.

To pour gasoline onto an already flammable situation, lenders fearing protocol insolvency are withdrawing their deposits, increasing pool utilization and interest rates! Some actors have taken things a step further and are actively contributing towards Egorov’s liquidation by increasing the borrow rate on his CRV Fraxlend position.

A ticking liquidation time bomb has started and protocols at risk have a matter of days to find a solution!

This disaster scenario didn't come out of nowhere, and is the result of a failure to recognize warning signs and reconsider CRV’s status as a collateral asset.

Aave previously suffered bad debt on its CRV market after liquidating a large short position in January, a clear indication of the market’s illiquidity. Gauntlet, a DeFi-native economic research firm, advised Aave’s governance to freeze borrows against CRV on its V2 market last month after Egorov was forced to re-margin his loan, a proposal which was unanimously rejected.

With the CRV/ETH pool now drained by the attack, the preeminent source of onchain CRV liquidity has vanished and liquidity is thinner than ever, meaning bad debt seems unavoidable in the event of a liquidation.

While the possibility for further DeFi contagion is possible, there are steps that you can take to limit your potential exposure to the fallout.

Squarely in the hot seat is CRV where a liquidation cascade appears extremely likely.

With a hacker now in control of a major percentage of the exchange’s liquid token supply and Egorov’s positions inching towards liquidation, the bottom looks primed to fall out of the market at any moment. If you do not have tremendous confidence in the possibility of a swift resolution, diamond-handing CRV is likely not for you.

Also in the firing line are the governance tokens of the lending platforms and stablecoin issuers that accept CRV as a collateral asset.

Even in the more optimistic scenario that they accrue no bad debt, a drop-off in TVL can be expected from protocols that are forced to liquidate CRV collateral, including Aave, Abracadabra, Fraxlend, Inverse, and Silo. Further problematic for these token holders is the possibility that their native tokens are used to paper over bad debt, which would create sell pressure and depress price.

In the event that protocols expend their entire insurance funds attempting to cover bad debt and are unwilling or unable to cover further realized losses via token dilution, contagion spreads one level deeper.

Isolated risk markets, like Fraxlend and Aave V3, isolate bad debt to those who knowingly assumed risk and lent funds against CRV positions; losses will be absorbed by these lenders. However, any lenders on a market that did not isolate risk, like Aave V2, or holders of a stablecoin collateralized by baskets of assets that includes CRV, like Abracadabra’s MIM, could be at risk of loss.

We have previously witnessed the implications of liquidation cascades numerous times throughout 2022 and given widespread usage as a collateral asset, a CRV liquidation cascade would likely be another true test for DeFi.

Undoubtedly, the scenario appears dire and it's worth reiterating that these are only the direct, onchain impacts of a CRV liquidation cascade; it is highly plausible that such a monstrous liquidation will have severe ramifications that are not yet visible.

The current scenario can be best summed up as “uncertain,’ and for the risk adverse, now is an excellent time to reconsider your asset allocation and potentially retreat into BTC, ETH, and stables. For the degen risk takoooor, however, now could be your opportunity to earn enhanced yields or allocate to a protocol you see as undervalued.

Whatever you do, proceed with caution 🤝