David Canellis

<div id="highlights-block_62702010422b2" class="highlights">
        <ul>
                <li>Smart contract hackers targeted merged DeFi projects Rari Capital and Fei Protocol to steal almost $80 million over the weekend</li>
                <li>Rather than seek VC funding to plug the losses, the Tribe DAO, which manages their governance, may vote to make users whole</li>
            </ul>
    
</div>



<p>Crypto platform Fei Protocol hopes a $10 million bounty “with no questions asked” will spur hackers to return nearly $80 million of digital assets stolen over the weekend.</p>



<p>Fei, the stablecoin issuer which merged with crypto lending startup Rari Capital just five months ago, made the <a href="https://twitter.com/feiprotocol/status/1520344430242254849" target="_blank" rel="noreferrer noopener">plea</a> on Twitter hours after the exploit — in which hackers infiltrated the platform’s lending pools — was detected Saturday.</p>



<p>“We are aware of an exploit on various Rari Fuse pools. We have identified the root cause and paused all borrowing to mitigate further damage,” Fei Protocol tweeted. “To the exploiter, please accept a [$10 million] bounty and no questions asked if you return the remaining user funds.”&nbsp;</p>



<p>Rari’s hacker leveraged a critical “<a href="https://consensys.github.io/smart-contract-best-practices/attacks/reentrancy/" target="_blank" rel="noreferrer noopener">reentrancy</a>” bug buried deep within the protocol’s code. These bugs involve smart contracts calling each other to move funds without appropriate checks.&nbsp;</p>



<p>For its codebase, Fei forked (read: copied) Ethereum money market platform Compound in early 2021. Compound enables crypto lending by valuing digital assets. It automatically determines borrowing limits and gauges market conditions to calculate interest rates.</p>



<p>Fei made certain changes to the code, however, and despite audits the flaw wasn&#8217;t discovered until it was too late.</p>



<p>Compound forks have <a href="https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million" target="_blank" rel="noreferrer noopener">suffered</a> similar fates in the past. Rari even <a href="https://medium.com/@JackLongarzo/rari-capital-fuse-security-upgrade-report-e5d154c16250" target="_blank" rel="noreferrer noopener">paid</a> $2 million to security researchers who had discovered a nearly identical flaw in March.</p>



<p>Decentralized exchange Uniswap, DeFi platform Cream Finance, and The Dao, among other projects, have fallen victim to reentrancy attacks dating back to 2016.&nbsp;</p>



<p>Rari also lost $11 million to smart contract hackers in an unrelated attack last May, then about 60% of the protocol’s capital.</p>



<p>In this case, Rari Fuse lending pools (which facilitate the lending of related ERC-20 tokens) effectively failed to keep track of how much cryptocurrency had been borrowed.</p>



<p>The setup illegitimately allowed for the borrowing of large amounts of cryptocurrency, withdrawal of the loan’s collateral and retention of borrowed funds, <a href="https://certik.medium.com/fei-protocol-incident-analysis-8527440696cc" target="_blank" rel="noreferrer noopener">according to smart contract auditor CertiK</a>.</p>



<p>The hackers flash-loaned $150 million worth of stablecoin USDC and 50,000 WETH ($141.5 million) to power more crypto loans from seven Rari Fuse pools.</p>



<p>After triggering a buggy “exitMarket” smart contract function, they withdrew the collateral, repaid the flash loan and kept the “borrowed” funds from Rari Fuse. The hackers repeated this process until they’d amassed roughly $80 million of crypto.</p>



<p>Rari Capital later <a href="https://twitter.com/RariCapital/status/1520651835081740290" target="_blank" rel="noreferrer noopener">disclosed</a> another 100 ETH had been hacked Sunday from a Fuse pool on layer-2 Ethereum platform Arbitrum.</p>



<p>BlockSec Chief Technology Officer Lei Wu confirmed to Blockworks that 5,400 ETH of the pilfered stash had been sent to crypto mixer <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>.</p>



<p>The stolen funds essentially belong to Rari Fuse users who had loaned their crypto. With this in mind, Fei Protocol is not exactly the victim — despite the exploit targeting its source code.&nbsp;</p>



<p>Rari developer Jack Longarzo told Blockworks that Rari’s Fuse platform and the Tribe DAO that manages Fei and Rari’s governance are the real victims. In fact, Tribe DAO may deliberate whether to release funds from its treasuries to make Rari Fuse users whole. Its treasury is currently worth $104 million, according to <a href="https://openorgs.info/" target="_blank" rel="noreferrer noopener">OpenOrgs</a>.</p>



<p>While there’s no formal bailout proposal as yet (and Longarzo wouldn’t comment on whether one was in the works), such a move would starkly contrast the VC-funded bailouts of other embattled DeFi platforms such as <a href="https://cms.blockworks.co/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses/" target="_blank" rel="noreferrer noopener">Wormhole</a> and <a href="https://cms.blockworks.co/the-ronin-hacker-made-off-with-625m-of-crypto-but-cashing-out-isnt-so-easy/" target="_blank" rel="noreferrer noopener">Ronin</a>, which have generally involved more centralized and private decision-making than a community vote.</p>



<p>But there is some indication that Tribe DAO participants may be losing faith. The DAO’s native token, TRIBE, is down 20% since the attack was first disclosed.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


Hacked Crypto Platform Offers ‘No Questions Asked’ $10M Bounty for Stolen Funds

Sam Martin

<div id="highlights-block_60c9fc7f1690b" class="highlights">
        <ul>
                <li>Bitcoin supply is becoming illiquid while CME futures activity picks up</li>
                <li>Bitcoin dominance continues its rally</li>
            </ul>
    
</div>



<h3 class="wp-block-heading">Expert Insight</h3>



<p>&#8220;We know at Genesis that the institutions are increasing their interest because we talk to them, but you know institutions take time to get all the due diligence. So, we know that the interest has been building. We also know that the liquid supply of Bitcoin has been declining because this is something you can see by simply looking at the on-chain data. </p>



<p>The buyers so far this year have mostly been long-term holders, which means that as more and more Bitcoin gets bought and tucked away in cold storage for investment purposes, there is less liquid supply for new buyers to purchase. So you have a growing institutional interest against the backdrop of declining liquid supply.&#8221;</p>



<p>-Noelle Acheson, Head of Market Insights at Genesis </p>



<h3 class="wp-block-heading">Bitcoin</h3>



<p>Historically speaking, the Bitcoin price and S&amp;P 500 have had a tight correlation. Since the beginning of October, that correlation has begun to weaken. Whether the trend will continue remains to be seen. </p>



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="910" height="661" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png" alt="" class="wp-image-9052" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=910 910w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=354 354w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=359 359w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=301 301w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTCUSD_2021-10-06_16-57-52.png?w=80 80w" sizes="auto, (max-width: 910px) 100vw, 910px" /><figcaption>Source: Trading View</figcaption></figure>



<p>BTC futures open interest on CME, a futures exchange where a lot of institutional activity takes place, has <a href="https://www.forbes.com/sites/javierpaz/2021/10/06/as-bitcoin-passes-55000-cme-futures-data-even-more-bullish/?sh=6459c277778c&amp;utm_source=TWITTER&amp;utm_medium=social&amp;utm_content=5658840587&amp;utm_campaign=sprinklrForbesCrypto" target="_blank" rel="noreferrer noopener">risen 33% </a>from September 7th to October 5th. </p>



<p> &#8220;The other thing that screams that this is institutionally driven for me is the CME basis. The CME derivatives exchange offers the lowest leverage of any crypto derivatives exchange,&#8221; Noelle Acheson of Genesis told Blockworks. &#8220;And yet the basis, which is the difference between the futures price on the CME and the spot price, started shooting up this morning. It&#8217;s now even higher than the basis on some of the other higher leverage futures exchanges.&#8221;</p>



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="959" height="536" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg" alt="" class="wp-image-9054" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=959 959w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=467 467w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/CME-OI.jpg?w=80 80w" sizes="auto, (max-width: 959px) 100vw, 959px" /></figure>



<h3 class="wp-block-heading">Ethereum</h3>



<p>With some of the other major Layer-1&#8217;s such as Solana ($SOL), Terra ($LUNA), and Binance Smart Chain ($BSC) underperforming and $ETH holding its ground, it appears that the rotation into the blue-chips of the digital asset industry is underway. </p>



<p>The put:call ratio for Ethereum sits at 0.647, according to <a href="https://app.laevitas.ch/dashboard" target="_blank" rel="noreferrer noopener">laevitas.ch</a>, signaling that traders are heavily favoring calls over puts. Perpetual funding rates are fairly high on some of the exchanges with the largest volume, indicating that traders taking a long position are paying hefty premiums to hold their position. It is currently at a 60.13% APR on the Binance ETH/USDT pair. </p>



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="980" height="296" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png" alt="" class="wp-image-9056" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=980 980w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.42.15-PM.png?w=80 80w" sizes="auto, (max-width: 980px) 100vw, 980px" /><figcaption>Source: https://app.laevitas.ch/dashboard/eth/derivs</figcaption></figure>



<h3 class="wp-block-heading">Non-Fungible Tokens (NFTs)</h3>



<p>NFTs continue their hot streak, notching $10 billion in sales for 2021 as of today according to a <a href="https://www.cnbc.com/2021/10/06/nft-trading-volume-hit-10-billion-2-reasons-why-people-are-buying.html" target="_blank" rel="noreferrer noopener">report from CNBC.</a> Bank of America also released an <a href="https://cms.blockworks.co/?p=9007" target="_blank" rel="noreferrer noopener">extensive report </a>on digital assets and had some interesting words on NFTs; “NFTs can be used instead of deeds, titles or anything currently needed to demonstrate ownership — and all without a middleman charging a fee”. Trading data from <a href="https://opensea.io/rankings" target="_blank" rel="noreferrer noopener">OpenSea</a> and <a href="https://solanalysis.com" target="_blank" rel="noreferrer noopener">Solanalysis</a> of some of the top Solana and Ethereum projects.</p>



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="358" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png" alt="" class="wp-image-9062" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.09-PM-1024x358.png?w=1274 1274w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Top Ethereum Projects</figcaption></figure>



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="293" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png" alt="" class="wp-image-9063" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-5.59.47-PM-1024x293.png?w=1235 1235w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Top Solana Projects </figcaption></figure>



<h3 class="wp-block-heading">DeFi</h3>



<ul class="wp-block-list"><li>Fei protocol, a project that aims to create a decentralized stable coin, made a <a href="https://medium.com/fei-protocol/introducing-fei-v2-6f56afe7a1b5" target="_blank" rel="noreferrer noopener">large upgrade</a> to the Fei mechanism. </li><li>Lido Finance, a non-custodial staking solution, <a href="https://blog.lido.fi/vulnerability-response-update/" target="_blank" rel="noreferrer noopener">responds</a> to some vulnerabilities that were reported yesterday. </li><li>Olympus DAO unveils a new service that aims to share Olympus&#8217; bond innovation with treasuries across DeFi, <a href="https://twitter.com/chasedevens/status/1445800257325912064?s=20" target="_blank" rel="noreferrer noopener">per messari analyst, Chase Devens.</a></li></ul>



<p>Total Value Locked (TVL) in DeFi is hovering around all-time-highs. </p>



<figure class="wp-block-image size-large"><img decoding="async" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-06-at-6.19.58-PM-1024x340-1.jpg" alt="" class="wp-image-9065"/><figcaption>Source: Defi Llama</figcaption></figure>



<h3 class="wp-block-heading">What else we are looking out for&#8230;</h3>



<ul class="wp-block-list"><li>Initial and continuing jobless claims on Thursday</li><li>Nonfarm payrolls, unemployment rate and average hourly earnings on Friday</li></ul>



<p>That is all for today, folks. Let&#8217;s do this again at the same time tomorrow. </p>



<hr class="wp-block-separator"/>



<p><strong>Are you a UK or EU reader that can&#8217;t get enough investor-focused content on digital assets?<a target="_blank" href="https://cms.blockworks.co/events/das-london/" rel="noreferrer noopener">Join us</a>&nbsp;in London on November 15th and 16th for the Digital Asset Summit (DAS) London. Use code ARTICLE for £75 off your ticket.&nbsp;<a target="_blank" href="https://cms.blockworks.co/events/das-london/" rel="noreferrer noopener">Buy it now</a>.</strong></p>



<hr class="wp-block-separator"/>


FEI

Newsletter

Blockworks Research