$62 000 USD





"SUSTAINABLE ALPHA FOR EVERYONE" "Earn yield on your cryptoassets with DeFi's first structured products protocol." "Ribbon Finance is a new protocol that helps users access crypto structured products for DeFi. It combines options, futures, and fixed income to improve a portfolio's risk-return profile."


"Theta Vault, which is a yield-focused strategy on ETH and WBTC. The vault earns yield on its deposits by running a weekly automated options selling strategy. The vault reinvests the yield earned back into the strategy, effectively compounding the yields for depositors over time."


"Ribbon's v1 and v2 Theta Vault contracts are audited. Despite the audits and security measures we have taken, we advice users to exercise caution and to not risk funds they are not willing to lose." Audits were found provided by Quantstamp, ChainSafe (2 audits), Peckshield, and OpenZeppelin. "We have an ongoing bug bounty on ImmuneFi, with up to $50,000 of bounty. The contracts that are included in the bounty are ETH and WBTC Theta Vaults."


"We recently found a small accounting bug in the Ribbon V2 contracts that charged users an additional week of fees when they were not supposed to be." "The total amounts were 11.79 ETH, 0.18 WBTC and 0.55 AAVE."


"The issue is that users were charged management fees upfront on the week they first deposited their funds. For example, if a user deposits on Thursday, they should only be charged fees on the following week’s Friday because their funds were utilized to write options and earn premiums. The undesirable behavior was that the users were charged the fees upfront."


"The vaults were charging an additional week of fees, even when users' funds were not deployed into the options contracts."


"This means that all V2 users would have been charged an additional week of fees when they should not have been."


"We have written and deployed the fix on the three v2 vaults, ETH, WBTC and AAVE. This ensures that new users are not overcharged."


"We just reimbursed all affected users." "We have distributed the fees back to all the affected users, and all V2 users should get back a rebate into their account." "Next, we used the erroneously collected fees from the DAO to deposit into the vaults. We then distributed the compensation amounts in vault tokens to all users who were affected." "The DAO Treasury has initiated a series of transactions to compensate for losses due to this bug, and the fix is deployed to the vaults so this does not happen again."

Ribbon Finance realized on November 23rd that, due to a bug in their smart contract, users were being overcharged. The platform compensated affected users in full based on what was overcharged.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.