Bankless: An Overview of the Curve Attack Incident and Its Potential Impact on DeFi Is Just Beginning?

Written by: Bankless

Compiled by: Felix, PANews

The smart contract programming language Vyper has a vulnerability, and with the depletion of liquidity pools and the imminent threat of liquidation, DeFi faces the risk of a spreading incident.

Attack Medium

In the early hours of July 31, the smart contract programming language Vyper tweeted that the reentrancy lock in versions 0.2.15, 0.2.16, and 0.3.0 has failed. Malicious actors exploited reentrancy attacks to repeatedly re-sign contracts, leading to unauthorized operations or stolen funds, with some significant projects including Curve Finance suffering attacks, with preliminary estimates of up to $70 million exploited. A portion of the funds is held by white hat hackers and MEV bots and may be recoverable.

Curve Bomb

Four liquidity pools in the Curve ecosystem—CRV/ETH, alETH/ETH, msETH/ETH, pETH/ETH—were attacked, resulting in over $45 million in liquidity lost from lending protocols Alchemix, synthetic asset Metronome, and NFT lending platform JPEG'd, with nearly $25 million flowing out of the CRV/ETH pool. Another potentially affected pool is the Arbitrum Tricrypto pool, but auditors and Vyper developers have not yet found exploitable vulnerabilities.

Additionally, DefiLlama data shows that Curve Finance's total value locked (TVL) has dropped from $3.266 billion on July 30 to $1.869 billion, a 24-hour decline of 42.78%.

CRV Price Volatility

Centralized exchanges show that the CRV price has bottomed out at $0.583, but the token hit a low of $0.109 on-chain. After the CRV/ETH pool was hacked, on-chain CRV liquidity deteriorated, leading to price volatility on-chain.

Despite the brutal sell-off of CRV, the hacker still has profits. A failed recovery will lead to CRV being sold off, which could have severe implications for lending protocols. Currently, the wallet still holds 7 million CRV (approximately $4.5 million).

Lending Warning

Curve founder Michael Egorov has obtained substantial loans using his CRV as collateral across various lending protocols, with the largest loan on Aave. If the CRV price reaches the liquidation threshold, the protocol will be forced to liquidate the CRV positions. According to crypto researcher 0xLoki, Michael Egorov currently has 292 million CRV (worth $181 million) collateralized, borrowing $110 million, mainly distributed as follows:

1. 190 million CRV collateralized on AAVE, borrowing $65 million, with a liquidation price of $0.37;

2. 46 million CRV collateralized on FRAXlend, borrowing 21 million FRAX, with a liquidation price of $0.4;

3. 40 million CRV deposited in Abracadabra, borrowing $18 million, with a liquidation price of $0.39;

4. 16 million CRV deposited in Inverse, borrowing $7 million, with a liquidation price of $0.4.

In the past 6 hours, Egorov has added approximately 10 million CRV in collateral on both AAVE and Abracadabra.

Repayment Frenzy

To avoid liquidation during sales, Michael Egorov has been repaying loan debts. In light of repayment efforts, Michael Egorov's new liquidation threshold for loans on Aave has been lowered to $0.37.

Early Warning

It is known that on-chain liquidity is insufficient to liquidate Michael Egorov's positions. Last month, the DeFi risk management firm Gauntlet attempted to freeze the CRV market on Aave, but their proposal was unanimously rejected.

Liquidity in the CRV/ETH pool of Curve has vanished. The decline in CRV liquidity is now lower than when Gauntlet made their proposal, and if positions are liquidated, bad debts seem inevitable.

DeFi Overflow

Once bad debts occur, lending protocols must tap into insurance funds. For example, Aave would sell AAVE tokens from its security module to cover any shortfalls, but the sale would reduce the value of the remaining collateral.

Liquidity Impact

Widespread volatility and remaining unknown factors will lead many to withdraw liquidity from Curve. As liquidity in Curve and other on-chain DEXs continues to decrease, prices will become increasingly unstable.

Lender Withdrawal

Lending institutions are racing to withdraw funds from money market protocols. The utilization rate of Aave's USDT pool exceeds 50%, with borrowing rates soaring to 91%, putting immense pressure on Michael Egorov's positions: if rates do not decrease, liquidation will occur within days.

Although the damage to the Curve pool may have already occurred, the potential impact of this exploitation on DeFi may just be beginning. Lending protocols associated with the CRV market may face serious bad debt risks, even if they do not go bankrupt.