IRON FINANCE

DESCRIPTION OF EVENTS

Iron Finance offers "a Partially-collateralized Stablecoin on the Binance Smart Chain". The iron token is "pegged to $1, partly backed by collateral like BUSD, and partially backed by STEEL. The collateralized ratio (CR), which is the collateralized and algorithmic ratio, depends on the market pricing of IRON. If the market demand for IRON is high, the system can be de-collateralized by decreasing the CR vis-a-vis when the demand is decreased."

"Started at 07:41:39 PM +UTC, May 7, 2021, ValueDeFi’s vSwap contract was exploited to drain a number of pools at the loss of about $11M." "AFFECTED IRON-STEEL 60%-40% vFarm STEEL-BUSD 70%-30% vFarm" "This incident was due to the mis-calculation by the protocol on the adopted weighted constant product invariant for non 50–50 ratio pools. There is no flashloan or price manipulation involved. The consequence of mis-calculated invariant allows for draining of affected pool funds. Currently, the bug has been exploited to attack 9 non 50–50 ratio pools with the estimated loss of $11M."

"Total exploited amount is about 4290 ETH and additional 900k$ in FARM, BAC and BASv2 which already been bridged to ETH." "Value DeFi posted on Telegram explaining that a cloud service (FaaS) upgrade changed the reward rate integer. However, the Iron Finance team was unaware. It updated the pools with a different reward rate integer which is what caused the incident."

"Following the Value DeFi incident which greatly affected our users, we are working tirelessly on rebuilding Iron Finance. Expect to hear from us progress updates on a daily basis as we strive to efficiently and promptly replace Value DeFi products and features. In parallel, we are trying to also keep pace with our Roadmap and other deliverables as planned."

"As you may know by now from following our Telegram group, the first step to re-build our protocol after the attack on ValueDefi is to find a new place for our liquidity pools and farms." "We are going to move our liquidity to PancakeSwap from ValueDefi." "Our farms with ValueDefi will be canceled and we are going to have our farms on our own brand new website, with a new design and interface."

Iron Finance had a couple of liquidity pools which had incorrect "adopted weighted constant product invariants" which caused an attacker to be able to exploit the error and drain funds from the pools.

HOW COULD THIS HAVE BEEN PREVENTED?

In general, it is not possible to be 100% certain that a smart contract is safe. Where smart contracts are necessary, community-based insurance can protect investors from the loss of all capital.

A more effective storage mechanism for funds would be an air-gapped multi-signature wallet.

Check Our Framework For Safe Secure Exchange Platforms

Re Build After Valuedefi Attack Part 1 (May 25)
Re Build After Valuedefi Attack And Other Updates Part 2 (May 25)
07 May 2021 Value Defi Incident Part 1 (May 26)
Iron The First Partial Collateralized Stablecoin On Binance Smart Chain (May 26)
Address 0xb88a8697eee4d9c7b5091649e8fc955a675b7570 | BscScan (Jul 3)
@bbbb Twitter (Jul 3)
Telegram: Contact @ValueDefi_Announcements (Jul 3)
Address 0xCB36b1ee0Af68Dce5578a487fF2Da81282512233 | Etherscan (Jul 3)
Address 0xb88a8697eee4d9c7b5091649e8fc955a675b7570 | Etherscan (Jul 3)
Valuedefi Incident Incorrect Weighted Constant Product Invariant Calculation (Jul 3)
Telegram: Contact @ValueDefi_Announcements (Jul 3)
@FrankResearcher Twitter (Jul 3)
Not Just a Bank Run: New Evidence Shows Iron Finance Crashed Due to Code Exploit - The Defiant - DeFi News (Jul 24)
Iron Finance Denies Rug Pull After Token Collapse | Crypto Briefing (Jul 24)

More case studies

Tanabata Finance/Taba
Finance Exit Scam

Rari Capital
Hack