RIBBON FINANCE

DESCRIPTION OF EVENTS

"SUSTAINABLE ALPHA FOR EVERYONE" "Earn yield on your cryptoassets with DeFi's first structured products protocol." "Ribbon Finance is a new protocol that helps users access crypto structured products for DeFi. It combines options, futures, and fixed income to improve a portfolio's risk-return profile."

"Theta Vault, which is a yield-focused strategy on ETH and WBTC. The vault earns yield on its deposits by running a weekly automated options selling strategy. The vault reinvests the yield earned back into the strategy, effectively compounding the yields for depositors over time."

"Ribbon's v1 and v2 Theta Vault contracts are audited. Despite the audits and security measures we have taken, we advice users to exercise caution and to not risk funds they are not willing to lose." Audits were found provided by Quantstamp, ChainSafe (2 audits), Peckshield, and OpenZeppelin. "We have an ongoing bug bounty on ImmuneFi, with up to $50,000 of bounty. The contracts that are included in the bounty are ETH and WBTC Theta Vaults."

"We recently found a small accounting bug in the Ribbon V2 contracts that charged users an additional week of fees when they were not supposed to be." "The total amounts were 11.79 ETH, 0.18 WBTC and 0.55 AAVE."

"The issue is that users were charged management fees upfront on the week they first deposited their funds. For example, if a user deposits on Thursday, they should only be charged fees on the following week’s Friday because their funds were utilized to write options and earn premiums. The undesirable behavior was that the users were charged the fees upfront."

"The vaults were charging an additional week of fees, even when users' funds were not deployed into the options contracts."

"This means that all V2 users would have been charged an additional week of fees when they should not have been."

"We have written and deployed the fix on the three v2 vaults, ETH, WBTC and AAVE. This ensures that new users are not overcharged."

"We just reimbursed all affected users." "We have distributed the fees back to all the affected users, and all V2 users should get back a rebate into their account." "Next, we used the erroneously collected fees from the DAO to deposit into the vaults. We then distributed the compensation amounts in vault tokens to all users who were affected." "The DAO Treasury has initiated a series of transactions to compensate for losses due to this bug, and the fix is deployed to the vaults so this does not happen again."

Ribbon Finance realized on November 23rd that, due to a bug in their smart contract, users were being overcharged. The platform compensated affected users in full based on what was overcharged.

Ribbon Finance: Crypto structured products on Ethereum (Oct 13)
Introduction to Ribbon - Ribbon Finance (Dec 5)
Security - Ribbon Finance (Dec 5)
audit/PeckShield-Audit-Report-Ribbon-v1.0.pdf at master · ribbon-finance/audit · GitHub (Dec 5)
audits/Ribbon-Audit_April-2021.pdf at main · ChainSafe/audits · GitHub (Dec 5)
audit/Quantstamp Theta Vault.pdf at master · ribbon-finance/audit · GitHub (Dec 5)
audit/RibbonThetaVault V2 Smart Contract Review And Verification.pdf at master · ribbon-finance/audit · GitHub (Dec 5)
Ribbon Finance Audit - OpenZeppelin blog (Dec 5)
https://coinmarketcap.com/currencies/ethereum/historical-data/ (Dec 21)
Bitcoin price today, BTC live marketcap, chart, and info | CoinMarketCap (May 16)
https://coinmarketcap.com/currencies/aave/historical-data/ (Dec 23)
@ribbonfinance Twitter (Dec 23)
Fix fee collection by kenchangh · Pull Request #159 · ribbon-finance/ribbon-v2 · GitHub (Dec 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Dec 23)
Compensation On Overcharged Deposits (Dec 23)
Ribbon Finance Crypto Explained (Automated Options Trading on the Blockchain) - YouTube (Mar 20)
https://www.cypherhunter.com/en/p/ribbon-finance/ (Mar 20)

More case studies

MetaMask MattoGio
Malware Fund Theft

Ploutoz Finance
Oracle Attack