Dear Bankless Nation,

Just when things seemed to be quieting down in crypto...

Yesterday, a nightmare exploit left hackers running away with tens of millions in crypto, but it's the second- and third-order effects of the theft that are leaving industry veterans frightened. What happens next could spell disaster for some of DeFi's largest lending protocols.

- Bankless team

DeFi is in Danger

Bankless Writer: Jack Inabinet | disclosures

Just a couple of weeks ago, Curve Finance founder Michael Egorov spoke too soon.

Early on Sunday, Vyper, a “pythonic smart contract language” and compiler for EVM applications, revealed that multiple versions of its compiler did not correctly implement the reentrancy lock. Multiple protocols were compromised yesterday as a result of this zero-day vulnerability and DeFi darling Curve was among the victims.

Nearly $70 million is estimated to have been displaced during the fiasco. While a meaningful percentage was taken by whitehat hackers and altruistic MEV bots (like c0ffeebabe.eth) and is recoverable, the exploiters sadly managed to walk away with a majority of the funds…

The curtains may have closed on the first chapter of this exploit, but it looks increasingly plausible that this fiasco is just beginning… DeFi may be on the brink of a major contagion event!

Numerous protocols accept Curve Finance (CRV) tokens as collateral, a perk fully utilized by Egorov, who took out $110 million in stablecoins loans across numerous protocols collateralized by 460M Curve Finance governance tokens (CRV), worth approximately $290M at current market prices.

The largest of the outstanding loans (nearly $70M) is collateralized by a whopping 34% of the circulating CRV supply. The loan is from Aave V2 and has a liquidation price of $0.376 per CRV. Should the exploiter attempt to swap out of their 7M stolen CRV tokens (8% of the circulating supply), the price would very likely fall below Egorov’s liquidation point for a sustained period of time, forcing the closure of his positions and exposing lenders to the possibility of bad debt during the liquidation process.

To pour gasoline onto an already flammable situation, lenders fearing protocol insolvency are withdrawing their deposits, increasing pool utilization and interest rates! Some actors have taken things a step further and are actively contributing towards Egorov’s liquidation by increasing the borrow rate on his CRV Fraxlend position.

A ticking liquidation time bomb has started and protocols at risk have a matter of days to find a solution!

This disaster scenario didn't come out of nowhere, and is the result of a failure to recognize warning signs and reconsider CRV’s status as a collateral asset.

Aave previously suffered bad debt on its CRV market after liquidating a large short position in January, a clear indication of the market’s illiquidity. Gauntlet, a DeFi-native economic research firm, advised Aave’s governance to freeze borrows against CRV on its V2 market last month after Egorov was forced to re-margin his loan, a proposal which was unanimously rejected.

With the CRV/ETH pool now drained by the attack, the preeminent source of onchain CRV liquidity has vanished and liquidity is thinner than ever, meaning bad debt seems unavoidable in the event of a liquidation.

While the possibility for further DeFi contagion is possible, there are steps that you can take to limit your potential exposure to the fallout.

Squarely in the hot seat is CRV where a liquidation cascade appears extremely likely.

With a hacker now in control of a major percentage of the exchange’s liquid token supply and Egorov’s positions inching towards liquidation, the bottom looks primed to fall out of the market at any moment. If you do not have tremendous confidence in the possibility of a swift resolution, diamond-handing CRV is likely not for you.

Also in the firing line are the governance tokens of the lending platforms and stablecoin issuers that accept CRV as a collateral asset.

Even in the more optimistic scenario that they accrue no bad debt, a drop-off in TVL can be expected from protocols that are forced to liquidate CRV collateral, including Aave, Abracadabra, Fraxlend, Inverse, and Silo. Further problematic for these token holders is the possibility that their native tokens are used to paper over bad debt, which would create sell pressure and depress price.

THANKS TO UNISWAP

Go direct to DeFi with the Uniswap mobile wallet. Buy crypto on any available chain with your debit card. Seamlessly swap on Mainnet and L2s. Explore tokens, wallets and NFTs. Safe, simple self-custody from the most trusted team in DeFi.

Download Uniswap Wallet

In the event that protocols expend their entire insurance funds attempting to cover bad debt and are unwilling or unable to cover further realized losses via token dilution, contagion spreads one level deeper.

Isolated risk markets, like Fraxlend and Aave V3, isolate bad debt to those who knowingly assumed risk and lent funds against CRV positions; losses will be absorbed by these lenders. However, any lenders on a market that did not isolate risk, like Aave V2, or holders of a stablecoin collateralized by baskets of assets that includes CRV, like Abracadabra’s MIM, could be at risk of loss.

We have previously witnessed the implications of liquidation cascades numerous times throughout 2022 and given widespread usage as a collateral asset, a CRV liquidation cascade would likely be another true test for DeFi.

Undoubtedly, the scenario appears dire and it's worth reiterating that these are only the direct, onchain impacts of a CRV liquidation cascade; it is highly plausible that such a monstrous liquidation will have severe ramifications that are not yet visible.

The current scenario can be best summed up as “uncertain," and for the risk adverse, now is an excellent time to reconsider your asset allocation and potentially retreat into BTC, ETH, and stables. For the degen risk takoooor, however, now could be your opportunity to earn enhanced yields or allocate to a protocol you see as undervalued.

Whatever you do, proceed with caution 🤝

MARKET MONDAY:

Scan this section and dig into anything interesting

*Data from 7/31 4:00 pm EST (DeFi Index = $DPI, NFT Index = $Blue-Chip-10)

Market Opportunities 💰

• Stake MATIC with MetaMask Portfolio
• Leverage your exposure to $WLD and go long or short with Ajna
• Lend and Borrow GMX and wstETH with Lodestar Finance
• Borrow GRAI on Arbitrum with lower minimums
• Bridge to Base mainnet

Yield Opportunities 🌾

• BTC: Earn 14.7% APR with Umami’s GLP WBTC vault on Arbitrum
• ETH: Earn 13.0% APY with Beefy’s wstETH-ETH vault on Polygon
• ETH: Earn 26.7% APY with Ribbon’s stETH covered call vault on Ethereum
• USD: Earn 4.6% APY with Coinbase by holding USDC
• USD: Earn 8.6% APY with Aave V3’s LUSD pool on Ethereum

What’s Hot 🔥

• Vyper vulnerability leads to massive $70M Curve hack
• PacWest merges with Banc of California +$400M equity infusion, latest “bank failure”
• Grayscale claims Coinbase SSA inadequate
• Feds drop campaign contributions charge against SBF
• Sequoia slashes crypto venture fund
• SEC charges Quantstamp for $28M ICO offering
• POTUS candidate Robert F. Kennedy claims to have purchased 14 $BTC
• Optimism surpasses Arbitrum in terms of daily transactions
• Synthetix sees largest 1-day trading volume
• Less than 75% of projects funded in 2021 have delivered a product to mainnet
• SEC comes out against misleading Proof of Reserves terminology
• Binance responds to CFTC, claims they don’t have jurisdiction
• The Fed, OCC, and FDIC announce “Basel III endgame” rules for large US banks
• Italy’s Central Bank looks to enter the RWA game, taps Polygon and Fireblocks
• Flashbots becomes a unicorn after $60M raise

Money reads 📚

• Thoughts on Biometric Proof of Personhood - Vitalik
• Take on the SEC’s Proof of Reserves Stance - Nic Carter
• The Future of Payments Includes Stablecoins - Brendan Malone
• Looking Ahead - Conic Finance
• Lattice Fund H2 2023 Portfolio Note - Regan Bozman

Governance Alpha 🚨

• Lyra team announces proposal for V2
• Maker further increases DSR to 8%

Token Hub: Lyra Finance (LYRA) 📈

Analyst: Jack Inabinet

We’re initiating coverage of Lyra Finance with a rating of bullish

Catalyst Overview:
Due to substantial improvements for the Lyra protocol and token proposed in the team’s V2 vision, we’re initiating coverage of LYRA with a rating of bullish.

Lyra has long been one of the easiest ways for degens to permissionlessly access crypto options, but the protocol is now moving to provide a comprehensive exchange experience by offering spot and perpetual trading markets. Settlement will be facilitated on Lyra Chain, an OP Stack rollup providing high throughput and low costs. Under a new tokenomic scheme, LYRA holders will receive trading fees, liquidation fees, interest rate spreads, and 50% of gas fees generated.

Despite the high historical profitability of providing liquidity on Lyra – flagship ETH LP pools have averaged 6-8% in real yield over the past 1.5 years – options must be fully collateralized, a requirement that makes the Lyra AMM highly capital inefficient. To combat this, Lyra V2 options writers can take advantage of portfolio margin. This feature will increase liquidity per dollar of TVL and allow Lyra V2 to support current volumes with less than 7% of its current TVL!

Price Impact:
Spot and perpetual trading volumes have migrated onchain in 2023 after many in crypto lost faith in centralized actors after the implosions of the year prior. Lyra may be a slightly longer-term play, as significant token price appreciation versus ETH will likely not occur until V2 launches, but the protocol is positioning itself to take advantage of this trend and establish itself as a clear leader in the crypto options space.

See more ratings in the Token Hub.

Meme of the Week 😂