ALCHEMIX

DESCRIPTION OF EVENTS

"Alchemix lets you reimagine the potential of DeFi by providing highly flexible instant loans that repay themselves over time. The synthetic protocol token (alUSD) is backed by future yield."

"Alchemix is an innovative, hybrid DeFi application that allows for the creation of yield-backed synthetic assets. With its unique ability to provide collateral that can also generate yield, Alchemix can offer a self-paying loan that has effectively no risk of liquidation. This product, “Vaults”, is the centerpiece of the Alchemix ecosystem and uses Yearn.finance as a building block for yield on underlying assets like DAI, with support for ETH and others coming soon." "While many stablecoin-backed DeFi lending platforms exist, most leave it up to the user to manage keeping the loan collateralized and paying it off. Alchemix seeks to automate this process for users interested in receiving stablecoin-backed loans."

"This process of repayment — which a user must typically complete manually elsewhere — is automated on the Alchemix crypto platform. Since alUSD continuously flows in as yield that is generated from Yearn.Finance, the supply of alUSD is automatically converted back to DAI at a 1:1 ratio in order to pay off the loan as yield is accrued."

"The DeFi lending agreement Alchemix alETH pool is suspected to have a loophole, and users can raise collateralized ETH when they have outstanding alETH debts. Alchemix released an alETH pool accident report stating that due to an error in the deployment of the alETH pool script, users have borrowed alETH at a 4:1 mortgage ratio but have no debt to be repaid, and the debt ceiling of nearly 2000 ETH has been released and new ones can be minted again. alETH, combined with Alchemix's use of the wrong index in the vault array, forced the transmuter to support the agreement mechanism to completely send the funds to repay the user's debt. The team has stopped the mortgage lending of the pool. As of the time of the report, alETH currently has a gap of -2,688.634, which is about 6.53 million U.S. dollars. Alchemix stated that there was no loss of user funds, and Yearn did not suffer any loss."

"On Wednesday June 16th @ approximately 12pm UTC, the call to Alchemist.harvest() that was supposed to pay off a small amount of borrower debt instead paid off all of the debt in the system. Additionally, between the time the harvest occurred and the Alchemix team paused minting, alETH loans were taken on credit that was produced as a result of the harvest, As such, there is approximately a 2200 shortfall of ETH/alETH in the system, all of which was distributed to system users."

"During today’s harvest — when token rewards are gathered and handed out proportionally to those holding tokens in the pool — a bug in the system led to withdrawals that shouldn’t have been allowed." "For an unknown amount of time, Alchemix borrowers could deposit ETH (+2.92%), get the project’s alETH token in return and then withdraw the ETH used to secure their loans without having to pay them back."

"Thankfully the damage was contained because of our conservative guarded launch and the whitelisting of certain function calls. In total, there is a 2688 ETH shortfall in the backing of alETH, but no user lost any of their own funds." "This is not at risk for happening again. We will redeploy the alETH vault and transmuter to ensure the vaults are indexed correctly. This will also clear out the maligned state."

"How are we going to put this right? We are asking our community to support the protocol, the DAO, and the devs, please consider distributing any excess ETH gained during this time to the new Transmuter, to allow it to back the outstanding loans that it created."

"We’re asking dedicated users who were involved in the alETH loan repayment incident if they’d like to return their accidental funds in exchange for ALCX tokens and a limited edition NFT with special DAO functionality."

"Our AMAZING community donated a combined total of 1206.63 ETH from our 2265.83 ETH deficit. This program will be closing on Monday, July 5th at 14:00 UTC. Shortly after this, we will do the ALCX airdrop for all who donated to our cause." "There will be a special NFT for those that returned their "free" alETH or ETH. A separate NFT for donations from accounts is under consideration. But please don't donate dust in hopes of getting a free NFT."

AS of July 12th, "alETH is back up, with an initial cap of 2000 alETH. Everyone, both Legend and Patron supporters are able to claim their 1:1 ETH-ALCX rewards. Legends can now claim their super exclusive NFT." "Legends: people who returned the reverse-rugged ETH/alETH. Patrons: people who generously donated ETH to the future of France. The Patron NFT will be made available soon."

Alchemix is a crypto lending platform. Unlike other platforms, they simultaneously invest your collateral in yield farming, which is then used to repay your loan automatically for you.

There was a bug where users loans were repaid too quickly, allowing them to withdraw their collateral sooner than they should have been. After resolving the bug, the team used various tactics to convince the community to return funds.

SlowMist Hacked - SlowMist Zone (May 18)
Alchemix - The Future Yield Tokenization Protocol (Jul 15)
@AlchemixFi Twitter (Jul 15)
@AlchemixFi Twitter (Jul 15)
@AlchemixFi Twitter (Jul 15)
@AlchemixFi Twitter (Jul 15)
@AlchemixFi Twitter (Jul 15)
@AlchemixFi Twitter (Jul 15)
Legendary alETH returners - Alchemix Governance (Jul 15)
Incident Report - 06162021 - Alchemix Governance (Jul 15)
'Free Money' Bug Hits DeFi Platform Alchemix - CoinDesk (Jul 15)
Alchemix Price - ALCX | Gemini (Jul 15)
Alchemix: Automated Crypto Loans with ALCX & ALUSD | Gemini (Jul 15)
DeFi loan platform Alchemix pauses alETH contract after bug (Jul 15)
@intocryptoast Twitter (Jul 15)
@n4n084191635 Twitter (Jul 15)
Rekt - Alchemix - REKT (Jul 31)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
Alchemix Farm Migration Post Mortem And Aleth Update (Aug 11)
@AlchemixFi Twitter (Aug 11)
Known Blockchain Lab | A Thousand Miles of Levee Collapsed in Ant's Den: A Brief Analysis of the Alchemix Incident | by Knownsec Blockchain Lab | Medium (Aug 11)
Slowmist Alchemix Hack Analysis (Aug 11)

More case studies

Bitcoin Trader
Sprayed In Eyes

Michael Saylor Bitcoin
Scam Siamese_Kalu