FORMATION FINANCE

DESCRIPTION OF EVENTS

"Smart Yield Farming 2.0. By adapting the three core principles from All Weather by Bridgewater for the yield farming environment, Risk Parity Protocol offers four classes of cross-chain yield-farming strategies."

"Formation Finance is an up-and-coming DeFi protocol aiming to use an innovation known as “cross-chain risk parity smart farming 2.0.” It’s designed to smooth and streamline the currently clunky user experience in DeFi while reducing overall risk exposure. Formation uses algorithms to select the optimal yield farming strategies tailored to a user’s risk tolerance, leveraging a vast range of assets across various blockchain platforms, including Ethereum, BSC, Polygon, and more."

"Risk parity algorithmically rebases the best performing farming strategies with a high degree of composability across major blockchain networks using the basic principles of the Risk Parity movement - achieved through algorithmic predictive intelligence."

"Through prioritizing secular diversification, the risk parity rebalancing mechanism sorts smart-asset allocation by pairing countertrend assets. This allows for iso-diversification construction to occur within our index coins to minimize risk fluctuations at a fundamental level - as it can detect levels of asset behaviors. Risk Parity Protocol rethinks and restructures how we interact with risks and it outperforms the most popular financially engineered strategies."

"When a user sets a level of risk with a minimum commitment amount determined by the algorithm in top reserve currencies such as BTC, ETH, DOT or BNB the protocol will automatically configure and recommend a chain-agnostic portfolio of yield farming strategies tailored for the risk profile of the user."

"On Saturday 20th November 2021, an attacker used an exploit on our network." "A hacker launched a flash loan attack to alter the price of the FORM token which the exploit contract excessively increases the value of the reward calculated at the withdrawal transaction."

"Some rewards from the liquidity pool were stolen." "We would like to reassure you that no investor funds, wallets or any information was affected, this was an exploit using a flash-loan only affecting the rewards pool."

"Farming contract has been using the balance of the pool for price discovery of the FORM token and LP token in order to calculate USD (stable coin) value of the position and pay rewards accordingly."

"Flash Swap mechanism allows to alter the price of the FORM token — the exploit contract used that in order to excessively increase the value of the reward calculated at the withdrawal transaction."

"(1) Stake LP token (transaction 1). (2) Pull available funds from the pool (alter the price of FORM token), unstake LP token and send back funds to the pool. (transaction 2)."

"[O]ur team reacted swiftly and effectively." "We were able to prevent this from happening by setting the multiplier to 0, which makes the contract send no FORMs for any new staked LP tokens." "[W]e had to disable parts of the platform to stop the attack. We are sorry for not communicating this effectively, but we had to act fast and stay ahead of the attacker."

"Only the rewards from the liquidity pool were affected. No investor funds, wallets or any information was affected." "Rest assured, this is not a huge issue as our team caught the attacker early and the loss was negligible, network hardening has been implemented and a solution is being deployed."

"Services are now being restored." "[W]e are pleased to announce that through our actions and the quick response from the dev team, we have identified the vulnerability and have been working hard to rectify and reinforce our systems and networks so that this never happens again."

Explore This Case Further On Our Wiki

Formation Finance is a risk management service which offers synthetic products with particular risk profiles to help retail investors manage the risks in their profile. An unknown amount of money was taken from the liquidity pool smart contract hot wallet via a flash loan exploit. The situation was quickly noticed and stopped by the team through a modification of contract rates. It appears the amount taken was minimal, however the team does not appear to have announced how anything will be recovered.

https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9 (Feb 1)
https://formation-fi.medium.com/greetings-formation-fi-community-supporters-investors-and-friends-b09d673cda8a (Feb 8)
Formation.fi | Formation Finance (Feb 8)
Formation Finance Founder Explains Why Crypto Startups Should Demand Value from VCs (Feb 8)
Formation Finance Explained - Get the BEST Risk/Reward in Crypto! | DeFi NOW - YouTube (Feb 8)
https://www.crunchbase.com/organization/formation-fi (Feb 8)
Formation Finance · GitHub (Feb 8)
https://bscscan.com/address/0xe2ee850d72d02b3D827b98847d332aDD0d3f0012 (Feb 8)
https://etherscan.io/address/0x62931dEce3411Ada1038C09cD01bAa11dB08334B (Feb 8)

More case studies

Phantom Galaxies
Discord Malware Attack

Unlock Protocol
Private Key Breach