DeFi Update: Trouble in AlphaTown—What Happened?
Hey all, Nick here.
As you can tell, the photo for this edition of Alpha Alarm is a bit gloomy today.
Why? You ask.
Alpha Homora v2 was exploited for a large sum of ether—which somehow acted as a negative event for the entire cryptocurrency market. It’s almost like the market was waiting for news to dump on.
Let’s take a look at what happened and if there’s anything else we can glean from DeFi over the past few days.
But before we get into it, a quick plug: if you want access to the exclusive interviews with top traders and industry executives, our research about DeFi and crypto trends, and the additional DeFi letter, you will need to subscribe. But have no fear, it’s only $14.99 a month, or $139.99 a year. Get yourself a belated holiday present and subscribe to Alpha Alarm today.
It’s literally the cost of one Uniswap trade a month or a few Starbucks coffees - it’s cheap.
Let’s cut to the chase: what happened with Alpha Homora v2 earlier this morning?
It was complicated, from what I’ve heard.
In the middle of what was my early morning, José Baredes (@josebaredes) noticed a suspicious address that was pushing a large amount of volume through contracts affiliated with Cream Finance, the money market, and Alpha Homora, the yield farming tooling platform.
Initial analysis by Igor Igamberdiev, an analyst at The Block, indicated that Iron Bank was the contract flawed here.
Iron Bank is an initiative launched by Cream to increase the capital efficiency of yield farms that use it. The basic idea is that whitelisted smart contracts can take undercollateralized/uncollateralized loans from the Iron Bank, giving depositors more yield and increasing the capital efficiency of those borrowing money from the Bank.
Igamberdiev indicated that the attacker used Alpha Homora to borrow sUSD, used Aave for flash loans, and Curve to swap stablecoins for one another, to create a complex web of contract calls that allowed them to borrow a large amount of capital from the Iron Bank—more than they were entitled to on paper. Additional analysis indicated that the attacker deployed a fake contract that allowed them to pretend they were Alpha Homora to acccess Iron Bank.
According to developer “Weeb_McGee,” the debt for this exploit actually falls on Alpha Homora users. He wrote:
“@CreamdotFinance users should be able to withdraw full amounts if they wished to. Meanwhile the lenders at Cream finance will enjoy extra lending APY until @AlphaFinanceLab can repay their debts to the Iron Bank.”
Alpha Finance Lab, the team behind Alpha Homora, is currently working on a post-mortem of the event to iron out what exactly happened, as DeFi Twitter has yet to come to a decisive conclusion on this by themselves.
ALPHA and CREAM have dropped since the news, as has a lot of the rest of the DeFi market.
As “Banteg” of the Yearn.finance team put it:
Even after the recent correction, it’s still been quite an explosive week for the crypto and DeFi market.
The biggest theme of this past week, as most blue chips (except for YFI) began to consolidate, was that of Ethereum “alternatives” or “competitors.” I’m not saying they are competitors right now, it’s just that the stated goal of some of these networks is to try and be networks that facilitate DeFi in a faster and potentially more efficient manner than Ethereum.
The native coins of Cardano, VeChain, Zilliqa, Binance Smart Chain, Avalanche, and more surged by over 50% each over the past seven days, of which most gains took place over the past four to five days.
We also saw NFT coins surge higher after Chamath Palihapitiya, the billionaire Silicon Valley entrepreneur, revealed that he has been accumulating NFTs, similar to Mark Cuban of the Dallas Mavericks.
What I’m keeping an eye on this week
To combine the last two sections of this newsletter, I have this: there have been a series of massive withdrawals amounting to tens of millions of dollars worth of SUSHI from Binance to seeming cold storage addresses.
It’s hard to say what exactly these addresses are until they make transactions other than recycling withdrawals from Binance.
Disclaimer: This author is an analyst at ParaFi Capital. ParaFi Capital may hold positions in assets mentioned in this article. The views displayed in this article are opinions of the author—and the author only.
That attack is really fascinating stuff. Just when I thought I knew something about defi, I realise I literally don't know anything about defi!