VOW CURRENCY

DESCRIPTION OF EVENTS

"The missing piece for global crypto adoption. Each year retailers lose $7 trillion of revenue by discounting. $VOW crystallises this lost value into something more."

"Cryptocurrency, in a large part, derives its value from speculation. $VOW changes this paradigm for the entire Crypto Industry. It is the key to unlocking global utility and thereby changing the world."

"99% of so called "crypto acceptance" is not real crypto acceptance.

Either a crypto debit card is used or a crypto/fiat gateway is used.

In either case, retailers are settled in fiat.

Retailers do not really accept crypto, and there are definitive reasons for this.

The three main reasons that retailers don't accept crypto are;

(1) Crypto is too volatile.

(2) Crypto is too slow.

(3) There is not enough demand from the public.

VOW fixes all three of these points at once, by introducing a unique token-economic model which incentivises every single Retailer to become part of a massive distribution and acceptance layer around the world."

"Discounts are used by retailers worldwide to excite customers and drive sales. They are not emoney, payment instruments, or crypto tokens." "Paper discount vouchers, all around the world, provide an annual $7 trillion pool of retailer distributed liquidity, that's waiting to be tapped." "When communities of retailers digitise their discounts and each stake $VOW worth 20% of their total issued discount value; a new form of decentralised value transfer is born."

"VOW LIMITED and its management, have successfully ensured that the VOW token is decentralized in its use by attracting a wide network of independent market participants - companies committed to using and consuming VOW tokens.

In addition, VOW LIMITED has ensured sufficient liquidity for the token to flourish on Ce-fi and De-fi markets. It has also gathered a large community who consume and utilize the currency throughout the world, thousands of social media followers, and a good reputation."

"The ecosystem’s ultimate and lofty goal is to decentralise the issuance of (fixed value) currency internationally in a manner which complements banks, governments, businesses, and consumers, and make this happen at unprecedented speed and scale. The method in which this is to be done is commercial, infinitely practical, and shouldn’t result in unnecessary challenges from regulators."

"The usdRateSetter had performed [previous adjustment] operations on 1 March 2024, changing the usdRate to 200, then to 5, and finally to 1, suggesting that the attacker was monitoring for future changes to the usdRate and immediately executed the attack once the opportunity arose."

"Two blocks before the attack, the usdRateSetter set the usdRate to 100. The usdRate had previously been set to one on 1 March 2024. This was not the first time the usdRateSetter had temporarily modified the usdRate. On 22 November 2023 and 1 March 2024 the usdRate was also temporarily changed to 150 and 200 respectively. However, these previous changes were not exploited."

"The amount of vUSD received per VOW token was temporarily changed from 1 to 100, giving the attacker 100x more vUSD than they would normally receive

Given it's not the first time the rate was temporarily changed, the attacker was likely waiting for it to happen again"

"The attack contract was deployed 110 days prior to the incident and executed within two blocks of the transaction that modified the usdRate."

"Having detected the rate change to 100, the attacker borrowed 1,486,625 VOW tokens from the Uniswap VOW-WETH pool and transferred them all to the VSCTokenManager contract. The purpose of this step was to burn the VOW tokens in exchange for vUSD."

"When the VSCTokenManager receives VOW tokens, it calculates the amount of vUSD that should be minted based on the usdRate. Since the usdRate was set to 100, the attacker received 100 vUSD for every VOW token burned. The attacker burned 1,486,625 VOW and therefore received 148,662,529 vUSD."

"The attacker used the vUSD to drain the VOW-vUSD pool, swapping out 148m vUSD for the 59m VOW tokens that were in the pool. The attacker then repaid 1,490,198 VOW tokens, for the initial borrow, to the VOW-WETH pool and used the remaining VOW to drain the VOW-USDT and VOW-WETH pools. In total they drained approximately 175 ETH, 595k USDT and 5.8M VOW."

"the loss of assets including: 175 ETH 595,970 USDT 5,801,632 VOW"

"After swapping assets to ETH the attacker has a total of 452 ETH (~$1.2m)"

"We want to clarify the recent incident that has occurred while our team was testing the USD rate setter function of the v$ contract in order to mint v$ for the new lending pool and oracle functions.

The USD rate was amended and 1m VOW was sent to the contract to test that everything was working as expected. This created, as expected v$100m, which is subsequently to be burned.

This time gap of making this change, testing, and reverting was around 15-30 seconds.

During this process, an unexpected event occurred where a bot acquired around 20 million VOW tokens from Uniswap and sent them to the contract resulting in nearly v$2 billion being created. The bot subsequently then sold the $2 billion v$ into the Uniswap pool.

This situation has caused a temporary disruption, and we understand the concerns this raises within the community. We want to assure you that we are fully committed to address this immediately and are actively working to resolve market conditions.

Our team is focused on mitigating the impact of this incident and restoring normal operations as quickly as possible. We are also implementing additional safeguards to prevent similar issues from occurring in the future.

We are considering the position carefully and what will happen next. There are several options on the table, all result in solving the situation and forward momentum of the project.

We greatly appreciate your patience and understanding during this time. Please keep calm as we continue to address the situation with the urgency it requires. We will provide further updates as soon as more information becomes available.

Thank you for your continued support and trust in the VOW project."

"As a further step, the vUSD burn rate (VSR) on Ethereum has been amended by the respective MVD. As stipulated in the white paper, VSR acts as a measure to keep vUSD supply in check. In order to maintain the VOW collateral requirement for every discount voucher in supply, the burn rate has now been increased to 50%. This will now help to bring vUSD supply back to its appropriate level, whilst other courses of action such as a vUSD fork to pre-exploit conditions are considered.

This rate will remain in place until the correct ratio is achieved. Please note that when swapping and sending vUSD this burn rate will now apply to all holder addresses."

Upset community members. Supply decrease of vUSD is still underway.

Vow aims to run the largest loyalty program in the world, on the blockchain in a decentralized manner, and appears to have some success in attracting retail participation. Unfortunately, their validation methods involve live changes to the exchange rate of the VOW token to the vUSD token, which is normally 1:1. An attacker exploited the higher rate immediately and liquidated the received tokens for ethereum. The Vow team has acted to decrease the supply of vUSD in various ways, however many in the community remain vocally upset and requesting compensation for their losses.

@Vowcurrency Twitter (Aug 15)
@CertiKAlert Twitter (Aug 15)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Aug 15)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Aug 15)
@quillaudits_ai Twitter (Aug 15)
Vow UP'22 | White Paper (Aug 15)
Vow UP'23 | White Paper (Aug 15)
Vow UP'24 | White Paper (Aug 15)
The Vow Ecosystem | White Paper (Aug 15)
The Problem | White Paper (Aug 15)
The Solution | White Paper (Aug 15)
The world's largest rewards economy | White Paper (Aug 15)
Financial Institutions | White Paper (Aug 15)
Enigmatic Smile | White Paper (Aug 15)
The Reward Collection | White Paper (Aug 15)
Token Details | White Paper (Aug 15)
@CertiKAlert Twitter (Aug 15)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Aug 15)
https://www.certik.com/resources/blog/vow-incident-analysis (Aug 15)
@Vowcurrency Twitter (Aug 15)
@Vowcurrency Twitter (Aug 15)
x.com (Aug 15)
x.com (Aug 15)
x.com (Aug 15)

More case studies

iVest DAO Smart Contract
Transfer Vulnerability

Bitcoin Whale 4064
BTC Fortune Captured