Jack Kubinec

<div id="highlights-block_632b7ffb18dd8" class="highlights">
 <ul>
 <li>Fei’s Tribe DAO voted to repay victims $80 million in stolen funds from its April hack</li>
 <li>The vote, conducted Monday, was the protocol’s fourth vote in what was a chaotic repayment process</li>
 </ul>
 
</div>



After months of mixed signals, victims of the $80 million Fei Protocol hack have finally been made whole.



Fei’s repayment plan — rolled out this week — caps off a chaotic last few months. The protocol first voted to repay victims of the hack, before changing course and only offering partial reimbursement. Following backlash, Fei’s DAO finally voted to fully recoup victims.



<a href="https://www.tally.xyz/profile/0x245cc372C84B3645Bf0Ffe6538620B04a217988B?governanceId=eip155:1:0x0BEF27FEB58e857046d630B2c03dFb7bae567494" target="_blank" rel="noreferrer noopener">Olympus DAO</a>, which lost $9 million in the <a href="https://cms.blockworks.co/hacked-crypto-platform-offers-no-questions-asked-10m-bounty-for-stolen-funds/" target="_blank" rel="noreferrer noopener">April hack</a>, cast an overwhelming 93 million of the 99 million votes in favor. The vote was one of the last governance decisions Fei’s Tribe DAO will make before being wound down. 



Months before the Fuse lending protocol hack, Fei <a href="https://cms.blockworks.co/a-match-made-in-defi-rari-capital-and-fei-protocol-merge-to-feirari/" target="_blank" rel="noreferrer noopener">merged</a> with lending protocol Rari Capital. The partnership hinted at things to come in terms of Fei’s insider governance.



“The way [the Fei-Rari merger] was structured was pretty brutal for anyone who was not a majority controlling shareholder,” DeFi researcher Luca Prosperi said.



After the newly-merged Fei was hacked in April, the Tribe DAO passed a <a href="https://snapshot.org/#/fei.eth/proposal/0x17f4d3b0f4d54296b4c36e79fa186d6379d0c0a1ac2b27a599780b5db853de43" target="_blank" rel="noreferrer noopener">Snapshot vote</a> to make hack victims whole. Fei then held a contentious <a href="https://www.tally.xyz/governance/eip155:1:0x0BEF27FEB58e857046d630B2c03dFb7bae567494/proposal/54737972228715148291831450377954475770670423675395942151334883116464258243647" target="_blank" rel="noreferrer noopener">second vote</a> that sided against full repayment and said it would wind down Tribe. 



Fei then <a href="https://tribe.fei.money/t/tip-121-proposal-for-the-future-of-the-tribe-dao/4475" target="_blank" rel="noreferrer noopener">proposed a plan</a> that would recoup less than 10% of the losses sustained by major Fei investors, such as Frax Finance and Olympus DAO. Sam Kazemian, the CEO of Frax, <a href="https://twitter.com/samkazemian/status/1560922676398436352?s=20&amp;t=oOWKvo0mELwq5gGRvN8T8Q" target="_blank" rel="noreferrer noopener">called the protocol’s actions fraud</a>. Fei’s team maintains it did nothing wrong.



“This is the most important fact to clear up,” Fei’s founder Joey Santoro told Blockworks. “The initial vote was a snapshot signaling poll which was non-binding.”



The second poll, which was on-chain and binding, was the poll that actually mattered, according to Santoro. Fei does not see the April hack as its own liability, as the hacked Fuse Protocol was run by Rari, which is still under a different team from Fei — despite the merger.&nbsp;



Fei’s hand-waving surrounding its post-hack votes illustrate how DAOs are not always permissionless, with insider developer teams sometimes controlling governance decisions and making centralized decisions behind the scenes.



“Ultimately when shit hits the fan and it&#8217;s about money, there is no protection,” Prosperi said. “It’s back to rule of the jungle.”



Fortunately for victims of the Fei hack, Fei’s team decided not to press its advantage. After Fei faced a firestorm for its proposed partial repayment plan, another <a href="https://snapshot.org/#/fei.eth/proposal/0xd5359654b34bba833843fb64ad38e813b4ff6cc21e6f5ea323b704d2ceb25d96" target="_blank" rel="noreferrer noopener">Snapshot vote</a> passed supporting full repayment, and <a href="https://www.tally.xyz/governance/eip155:1:0x0BEF27FEB58e857046d630B2c03dFb7bae567494/proposal/18409504155893955395764219200342193055990239653098975117323864343432865890837" target="_blank" rel="noreferrer noopener">a fourth vote</a>, passed and executed Monday, returned the lost funds.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

Fei Flips Again, Repays Crypto Hack Victims

David Canellis

<div id="highlights-block_62702010422b2" class="highlights">
 <ul>
 <li>Smart contract hackers targeted merged DeFi projects Rari Capital and Fei Protocol to steal almost $80 million over the weekend</li>
 <li>Rather than seek VC funding to plug the losses, the Tribe DAO, which manages their governance, may vote to make users whole</li>
 </ul>
 
</div>



Crypto platform Fei Protocol hopes a $10 million bounty “with no questions asked” will spur hackers to return nearly $80 million of digital assets stolen over the weekend.



Fei, the stablecoin issuer which merged with crypto lending startup Rari Capital just five months ago, made the <a href="https://twitter.com/feiprotocol/status/1520344430242254849" target="_blank" rel="noreferrer noopener">plea</a> on Twitter hours after the exploit — in which hackers infiltrated the platform’s lending pools — was detected Saturday.



“We are aware of an exploit on various Rari Fuse pools. We have identified the root cause and paused all borrowing to mitigate further damage,” Fei Protocol tweeted. “To the exploiter, please accept a [$10 million] bounty and no questions asked if you return the remaining user funds.”&nbsp;



Rari’s hacker leveraged a critical “<a href="https://consensys.github.io/smart-contract-best-practices/attacks/reentrancy/" target="_blank" rel="noreferrer noopener">reentrancy</a>” bug buried deep within the protocol’s code. These bugs involve smart contracts calling each other to move funds without appropriate checks.&nbsp;



For its codebase, Fei forked (read: copied) Ethereum money market platform Compound in early 2021. Compound enables crypto lending by valuing digital assets. It automatically determines borrowing limits and gauges market conditions to calculate interest rates.



Fei made certain changes to the code, however, and despite audits the flaw wasn&#8217;t discovered until it was too late.



Compound forks have <a href="https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million" target="_blank" rel="noreferrer noopener">suffered</a> similar fates in the past. Rari even <a href="https://medium.com/@JackLongarzo/rari-capital-fuse-security-upgrade-report-e5d154c16250" target="_blank" rel="noreferrer noopener">paid</a> $2 million to security researchers who had discovered a nearly identical flaw in March.



Decentralized exchange Uniswap, DeFi platform Cream Finance, and The Dao, among other projects, have fallen victim to reentrancy attacks dating back to 2016.&nbsp;



Rari also lost $11 million to smart contract hackers in an unrelated attack last May, then about 60% of the protocol’s capital.



In this case, Rari Fuse lending pools (which facilitate the lending of related ERC-20 tokens) effectively failed to keep track of how much cryptocurrency had been borrowed.



The setup illegitimately allowed for the borrowing of large amounts of cryptocurrency, withdrawal of the loan’s collateral and retention of borrowed funds, <a href="https://certik.medium.com/fei-protocol-incident-analysis-8527440696cc" target="_blank" rel="noreferrer noopener">according to smart contract auditor CertiK</a>.



The hackers flash-loaned $150 million worth of stablecoin USDC and 50,000 WETH ($141.5 million) to power more crypto loans from seven Rari Fuse pools.



After triggering a buggy “exitMarket” smart contract function, they withdrew the collateral, repaid the flash loan and kept the “borrowed” funds from Rari Fuse. The hackers repeated this process until they’d amassed roughly $80 million of crypto.



Rari Capital later <a href="https://twitter.com/RariCapital/status/1520651835081740290" target="_blank" rel="noreferrer noopener">disclosed</a> another 100 ETH had been hacked Sunday from a Fuse pool on layer-2 Ethereum platform Arbitrum.



BlockSec Chief Technology Officer Lei Wu confirmed to Blockworks that 5,400 ETH of the pilfered stash had been sent to crypto mixer <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>.



The stolen funds essentially belong to Rari Fuse users who had loaned their crypto. With this in mind, Fei Protocol is not exactly the victim — despite the exploit targeting its source code.&nbsp;



Rari developer Jack Longarzo told Blockworks that Rari’s Fuse platform and the Tribe DAO that manages Fei and Rari’s governance are the real victims. In fact, Tribe DAO may deliberate whether to release funds from its treasuries to make Rari Fuse users whole. Its treasury is currently worth $104 million, according to <a href="https://openorgs.info/" target="_blank" rel="noreferrer noopener">OpenOrgs</a>.



While there’s no formal bailout proposal as yet (and Longarzo wouldn’t comment on whether one was in the works), such a move would starkly contrast the VC-funded bailouts of other embattled DeFi platforms such as <a href="https://cms.blockworks.co/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses/" target="_blank" rel="noreferrer noopener">Wormhole</a> and <a href="https://cms.blockworks.co/the-ronin-hacker-made-off-with-625m-of-crypto-but-cashing-out-isnt-so-easy/" target="_blank" rel="noreferrer noopener">Ronin</a>, which have generally involved more centralized and private decision-making than a community vote.



But there is some indication that Tribe DAO participants may be losing faith. The DAO’s native token, TRIBE, is down 20% since the attack was first disclosed.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

Hacked Crypto Platform Offers ‘No Questions Asked’ $10M Bounty for Stolen Funds

Macauley Peterson

<div id="highlights-block_61c28b2f42ea7" class="highlights">
 <ul>
 <li>The combined protocols will operate using one token, TRIBE, but keep their developer teams intact</li>
 <li>Rari’s core product gains a dedicated stablecoin, FEI, while the Fei Protocol will become more useful in DeFi thanks to Rari’s borrowing and lending pools</li>
 </ul>
 
</div>



A pair of ambitious DAO communities led by young hotshot developer teams pulled off a massive merger via dual votes that ended Monday at midnight UTC. The precedent-setting example of on-chain governance puts in motion a concatenation of talent and code, in what its backers say will yield a DeFi powerhouse in 2022.&nbsp;



Holders of Rari’s RGT governance token voted <a href="https://www.withtally.com/governance/rari/proposal/9" target="_blank" rel="noreferrer noopener">overwhelmingly in favor</a> of the deal, <a href="https://www.withtally.com/governance/fei/proposal/100913008905461844936601668456794711523658459114127771687920359665569753117360" target="_blank" rel="noreferrer noopener">as did holders</a> of Fei’s governance token TRIBE, which will subsume the former. But to get to that outcome required some political maneuvering. The Rari and Fei development teams <a href="https://twitter.com/joey__santoro/status/1460693387426729987?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1460693387426729987%7Ctwgr%5E%7Ctwcon%5Es1_c10&amp;ref_url=https%3A%2F%2Fwww.coindesk.com%2Ftech%2F2021%2F11%2F23%2Frari-capital-fei-protocol-look-to-overcome-bagholder-bias-in-ambitious-defi-merger%2F" target="_blank" rel="noreferrer noopener">initially proposed</a> the idea of joining forces in mid-November, however, only after several weeks and a few rounds of modifications to the deal terms did the wider Fei and Rari communities embrace the concept.



<h3 class="wp-block-heading">What is Rari?</h3>



Rari Capital was <a href="https://medium.com/rari-capital?p=9c0820944d77" target="_blank" rel="noreferrer noopener">founded</a> by Jai Bhavnani, Jack Lipstone and David Lucid in July 2020 — when all were under 20 years old and already had <a href="https://www.forbes.com/sites/rorymurray/2020/08/03/teen-crypto-entrepreneurs-may-be-the-real-adults-in-the-room" target="_blank" rel="noreferrer noopener">one DeFi startup</a> under their belts. Rari started as a sort of robo-advisor for generating yield from stablecoins, but over the past 18 months has grown and evolved into a money market-like protocol with about $1.4 billion in total value locked — mostly stablecoins and DeFi-related tokens on Ethereum.



The chief innovation, the one that comes closest to product-market fit, was the group’s <a href="https://app.rari.capital/fuse" target="_blank" rel="noreferrer noopener">Fuse</a> offering, an “open interest rate protocol” which permits the permissionless creation of bespoke borrowing and lending pools using dozens of Ethereum-based assets. The FEI stablecoin is already integrated in several such pools.



<h3 class="wp-block-heading">What is Fei?</h3>



Fei Protocol launched just nine months ago, as a novel iteration on the concept of a crypto-collateralized stablecoin. Like its forerunner, DAI — the stablecoin launched by <a href="https://cms.blockworks.co/?s=makerdao" target="_blank" rel="noreferrer noopener">MakerDAO</a> <a href="https://medium.com/@MakerDAO/dai-is-now-live-ad87e34fc826" target="_blank" rel="noreferrer noopener">four years ago</a> — FEI is backed mostly by ether. But unlike DAI, FEI is collateralized by an algorithmic reserve of protocol-controlled value (PCV), and it emphasizes liquidity rather than over-collateralization.



At its <a href="https://medium.com/fei-protocol/fei-protocol-genesis-group-d6cf1d266139" target="_blank" rel="noreferrer noopener">genesis</a>, FEI was backed solely by ether, but today the PCV consists of about 68% ether and the rest a mix of other assets, primarily other decentralized stablecoins. Unlike centralized stablecoins such as USDT and USDC, which back their issuance with off-chain reserves of US dollars, Treasurys and other assets, FEI’s backing resides entirely in the protocol’s smart contracts running on Ethereum.



<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/r8YZDyI2sQUub-wY4gMBQxa-RCeP6z2iDLNgqHTr9X5lTkfyb37ChunnCHz8PzV73z8LF3eUkz3GYIP-kVly7ayZ0BfjR5LQ6D1SOWHFl65EGwp8AAT2lYhzfdF-s7IXaEadjsK3" alt=""/><figcaption><meta charset="utf-8">Source: fei.money</figcaption></figure>



Fei was founded by Joey Santoro, a 2019 graduate in computer science at Duke University, who was inspired by an ill-fated algorithmic stablecoin called Empty Set Dollar (ESD), which <a href="https://www.aier.org/article/algorithmic-stablecoins/" target="_blank" rel="noreferrer noopener">irrevocably lost its peg</a> to the US dollar in December 2020, just a few months after launch. Santoro even did some work on ESD, but felt the system could be radically improved, and began work on Fei, as he related in <a href="https://player.fm/series/epicenter-learn-about-crypto-blockchain-ethereum-bitcoin-and-distributed-technologies-41400/joey-santoro-fei-protocol-introducing-fei-v2" target="_blank" rel="noreferrer noopener">a recent interview</a> with Epicenter.



Fei Protocol <a href="https://docs.fei.money/protocol/fei-stablecoin" target="_blank" rel="noreferrer noopener">mints FEI</a> when users sell ether to the protocol. That ETH is deployed into a <a href="https://v2.info.uniswap.org/pair/0x94b0a3d511b6ecdb17ebf877278ab030acb0a878" target="_blank" rel="noreferrer noopener">Uniswap liquidity pool</a> — one which is predominantly supplied by the Fei Protocol itself. Economic incentives generally keep FEI <a href="https://www.coingecko.com/en/coins/fei-usd/usd#panel" target="_blank" rel="noreferrer noopener">within a fraction of a cent</a> of its $1 peg, aided by a novel algorithmic stability mechanism called a <a href="https://docs.fei.money/developer/contract-docs/ethuniswappcvcontroller#reweight" target="_blank" rel="noreferrer noopener">reweight</a> that is made possible by the fact that Fei owns its own liquidity.



There are about $734 million FEI in circulation, with $1.06 billion in PCV — about 137% over-collateralization. For comparison, the $9.2 billion in DAI has roughly $18.5 billion in ETH, WBTC and the USDC stablecoin backing it — about 200%. So FEI is more capital efficient.



<h3 class="wp-block-heading">Convincing the critics</h3>



Santoro outlined a symbiotic relationship for the two protocols in <a href="https://twitter.com/joey__santoro/status/1460693390287257600?s=20" target="_blank" rel="noreferrer noopener">his initial Twitter thread</a> on Nov. 16:



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“Fei can permissionlessly grow the utility and use cases for Fuse, including streamlined lending bootstrapping and manipulation-resistant oracles. Rari is an ideal platform to enhance FEI demand and utility, as well as a place for PCV to grow via the upcoming Vaults,” Santoro wrote.</blockquote>



But both communities were initially skeptical. Some TRIBE partisans <a href="https://tribe.fei.money/t/fip-51-fei-rari-token-merge/3642/4" target="_blank" rel="noreferrer noopener">were reluctant</a> to assume liability for <a href="https://halborn.com/explained-the-rari-capital-hack-may-2021/" target="_blank" rel="noreferrer noopener">a May 2021 exploit</a> suffered by Rari, which lost the protocol’s users $11 million in ether. Meanwhile, ardent Rarians <a href="https://forums.rari.capital/d/177-feirari-token-merge/6" target="_blank" rel="noreferrer noopener">insisted</a> that RGT was undervalued, and were reluctant to exchange it for TRIBE.



Ultimately, the merger proposal called for a one-year minimum window for RGT holders to swap their tokens for TRIBE at a fixed rate of about 26.7 TRIBE per RGT. There’s also a “TribeRagequit” provision, that will allow TRIBE holders to exchange their tokens for FEI, if they don’t want any part of the combined entity.



The final version attained the support of over 90% of both groups.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">You will see Fei and Rari charging forward as a united force bootstrapping L2s and scaling Ethereum together. We will be tackling Ethereum&#39;s scaling issues head on, driving liquidity to L2s, and leaving any doubters of Ethereum&#39;s scaling capabilities with their jaws on the floor.&mdash; Jack Longarzo 1+1=3 (@JackLongarzo) <a href="https://twitter.com/JackLongarzo/status/1468297688848515080?ref_src=twsrc%5Etfw">December 7, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<h3 class="wp-block-heading">A new model for DAOs to join forces</h3>



Jeff Amico, crypto partner at a16z, <a href="https://twitter.com/_jamico/status/1472982852195205137" target="_blank" rel="noreferrer noopener">called the merger</a>, “A new primitive to align incentives between web3 communities going forward.”



This wasn’t the first time that two DeFi protocols linked up. Yearn Finance engaged in token swaps and close collaboration with multiple protocols, <a href="https://thedefiant.io/sushiswap-is-largest-target-in-yearn-merger-wave/" target="_blank" rel="noreferrer noopener">notably Sushi</a> in 2020. But the fact that Rari and Fei will jointly operate under the TRIBE token makes this case stand out.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The FeiRari merge vote passed and Fei v2 executed on chain in the span of 24h. As if that wasn’t enough, today we are also launching the beautiful v2 web app 🔥 What a way to end the year! 🌲🌄<a href="https://t.co/HHeQHpdxJj">https://t.co/HHeQHpdxJj</a>&mdash; Seb 🌲 (@sdalcega) <a href="https://twitter.com/sdalcega/status/1473086927410765827?ref_src=twsrc%5Etfw">December 21, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Will we see more protocols attempt to follow the FeiRari lead? And how fast can this souped-up DAO engine innovate? Both questions DeFi watchers will be contemplating heading into the New Year. 



<hr class="wp-block-separator"/>



Get the day’s top crypto news and insights delivered to your inbox every evening. <a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a> now.



<hr class="wp-block-separator"/>