Andrew Thurman


<p>One of the strongest-performing digital assets of the week has been at least temporarily derailed by a code vulnerability.&nbsp;</p>



<p>On Wednesday, THORChain — among the oldest DeFi projects — announced that the protocol had suspended a number of core functions due to a security vulnerability disclosure in a TSS (threshold signature scheme) library maintained by Binance Smart Chain. </p>



<p>Over the past three days, the project has suspended functionality for a number of operations relating to their nodes, which rely on the TSS. The project primarily focuses on <a href="https://blockworks.co/news/native-bitcoin-in-defi-this-dex-wants-to-boost-trust">enabling cross-chain asset swaps</a> with a variety of features. </p>



<p>The team has <a href="https://twitter.com/THORChain/status/1691793526382789044">stated</a> in public channels that they have a patch for their node operators ready, but are waiting on other projects that rely on the TSS library to prepare their own patches and avoid putting those projects at risk. </p>



<p>The statement pumped the brakes on what had been a strong run for THORChain’s Rune liquidity token. Rune had rallied 60% on the week in advance of the release of a new lending product, but the surge has stalled with the token dropping 3% on the day.&nbsp;</p>



<p>Multiple THORChain team members did not respond to requests for comment by the time of publication.&nbsp;</p>



<h1 class="wp-block-heading">TSS vulnerability</h1>



<p>On Wednesday, the official THORChain Twitter account replied to a tweet announcing that trading had been paused across eight chains, writing that “most TSS libraries in production are vulnerable to a TSS security issue.”</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">A responsible disclosure indicates that most TSS libraries in production are vulnerable to a TSS security issue. <br><br>All users of GG18/GG20 should reach out to TC core devs immediately. <br><br>THORChain has paused key-signing until a patch can be released. <a href="https://t.co/qRrcrva9er">https://t.co/qRrcrva9er</a></p>&mdash; THORChain (@THORChain) <a href="https://twitter.com/THORChain/status/1691793526382789044?ref_src=twsrc%5Etfw">August 16, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>The vulnerability was first discussed in the THORChain developer Discord server on Aug. 13. A team representative wrote that “a recent disclosure to Binance around their TSS implementation has caused them to make a security patch to the code.” </p>



<p>This prompted the THORSec security advisory and THORNode node operation teams to pause “churning” — the process by which validators are added and removed from the network — until a THORNode patch could be released. Per THORChain documentation, the protocol’s TSS relies primarily on two libraries, including Binance’s.</p>



<p>In an interview with Blockworks, pseudonymous developer GiMa of Maya Protocol — a fork of THORChain — said both teams have a patch ready, but are waiting on other teams to respond to the disclosure before releasing. In a statement on the THORChain Telegram, GiMa added they expect the patch to be released in &#8220;24 — 48&#8221; hours. </p>



<p>While it’s unclear how many active teams are potentially affected, Binance Smart Chain’s TSS Github has been <a href="https://github.com/bnb-chain/tss-lib/forks">forked</a> 50 times in the last two years.&nbsp;</p>



<p>The THORChain team announced on Tuesday night that due to the vulnerability, security advisors had recommended delaying the launch of a forthcoming lending product. </p>



<p>Traders have responded to the various disclosures with apprehension, sending the price of Rune down 8% from 24-hour highs, falling to $1.48 from $1.61 per CoinGecko.&nbsp;</p>



<h1 class="wp-block-heading">Lending and options</h1>



<p>Prior to the TSS disclosures, THORChain’s Rune liquidity token had been on a tear — largely due to anticipation around the lending product.</p>



<p>In a recent Twitter space community <a href="https://twitter.com/THORChain/status/1691574556794794243">call</a>, Thorchain developer Chad Barraford touted the new product as revolutionary.&nbsp;</p>



<p>“When lending launches, we are, in my view, overnight, going to make the industry look like a bunch of dinosaurs. We’ve developed an entirely different design that makes the old one look like shit, to be honest. It is a very novel idea and experimental,” he said.&nbsp;&nbsp;</p>



<p>Key features advertised in the THORfi Lending <a href="https://docs.thorchain.org/thorchain-finance/lending">documentation</a> include “0% interest, no liquidations and no expiration.”</p>



<p>However, while THORfi Lending is being marketed as a revolutionary lending platform, many <a href="https://twitter.com/TehSlaw/status/1691167395900002304">observers</a> have said that it functions closer to an options platform, with the new protocol acting as the issuer. Borrowers take loans denominated in dollar terms, and have the ability to “buy back” their collateral at a particular price. The protocol, meanwhile, sells the collateral at origination, and buys it back at the “exercising” of the option.&nbsp;</p>



<p>A recent HackMD risk <a href="https://hackmd.io/@blockscience/H1Q-erh_n/%2FgedrnocFRxOWWgT8TXJ-sw">report</a> concluded that “a [THORfi] loan behaves formally the same as an American call option,” and that the risks of the lending product to the wider protocol can be considered in similar terms to those posed to an options issuer.&nbsp;&nbsp;</p>



<p>Notably, the new product also brings new token economic features.&nbsp;</p>



<p>One aspect is a significant potential boost in volume for Rune. As with single-sided liquidity deposits into the THORChain DEX as well as certain cross-chain transactions, Rune is used as an intermediary liquidity asset (a BTC to ETH swap is routed through BTC/RUNE, then RUNE/ETH).&nbsp;</p>



<p>This has led to some speculation that Rune could benefit from additional frequent buy pressure from the protocol itself. Additionally, the lend product will also feature a <a href="https://twitter.com/THORChain/status/1689595386602897408">burn</a> mechanism.&nbsp;</p>



<p>Despite the recent pump and price volatility, Rune remains down 92% from an all-time high of $21.07 reached in May 2021.&nbsp;</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.</strong></p>



<p><strong>Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.</strong></p>



<p><strong>Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.</strong></p>



<p><strong>The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.</strong></p>


Code vulnerability puts damper on RUNE’s wild run

Sam Martin

<div id="highlights-block_60c9fc7f1690b" class="highlights">
        <ul>
                <li>Bitcoin dominance up sharply on today&#8217;s rally</li>
                <li>US Bank launches crypto custody service to satisfy demand</li>
            </ul>
    
</div>



<p>The NASDAQ and Dow Jones closed the day up 1.25% and 0.92% respectively. </p>



<p><a href="https://cms.blockworks.co/banking-giant-launches-custody-services-for-bitcoin/" target="_blank" rel="noreferrer noopener">US Bank</a> will be launching a crypto custody solution powered by NYDIG. It will only offer bitcoin, with the intention to support additional coins over time.</p>



<p>Brazil is set to vote on a bill within the next few days to <a href="https://finance.yahoo.com/news/bitcoin-set-become-legal-payment-154644863.html?guccounter=1&amp;guce_referrer=aHR0cHM6Ly90LmNvL0JBQnlBVm9vYkY_YW1wPTE&amp;guce_referrer_sig=AQAAAIQkO8ZzOBl0aoKUt_nsS8PkNhQvgAetH_aKIpgFeO8PjIkkHSdHhQRJrnpSnq7NWLBdGiBiQm5yAJ6q53KgD-3lxKUM5sM9pqaafhXhPkopI_WhwJyacAXLboQPCauMMhMFi3TvNJAT3mOrXLQkMlipNxkp99NiPznVHFDCoIQm" target="_blank" rel="noreferrer noopener">regulate</a> Bitcoin in a way that encourages its use. </p>



<h3 class="wp-block-heading">DeFi/NFTs/Gaming</h3>



<ul class="wp-block-list"><li>The game studio behind Axie infinity, Sky Mavis, received $152 million in a <a href="https://cms.blockworks.co/axie-infinity-developer-scores-152m-in-series-b-funding-nearing-3b-valuation/" target="_blank" rel="noreferrer noopener">series B funding</a> round led by Andreessen Horowitz. <a href="https://coinmarketcap.com/currencies/axie-infinity/" target="_blank" rel="noreferrer noopener">$AXS</a> was last trading at $130, down 6% after its remarkable run the past week. </li><li>ThorChain-based decentralized exchange, ThorSwap, <a href="https://finance.yahoo.com/news/thorswap-raises-3-75m-private-141222643.html" target="_blank" rel="noreferrer noopener">raised</a> $3.75 million in a private token sale. <a href="https://coinmarketcap.com/currencies/thorchain/" target="_blank" rel="noreferrer noopener">$RUNE</a> was last trading around $8.90. </li><li>Nexus Mutual (<a href="https://coinmarketcap.com/currencies/nxm/" target="_blank" rel="noreferrer noopener">$NXM)</a>, an insurance protocol built on top of ethereum, passed <a href="https://twitter.com/NexusMutual/status/1445327767474688007?s=20" target="_blank" rel="noreferrer noopener">proposal 157</a> to allocate nearly $50 million to earn ETH2.0 staking rewards through Lido Finance(<a href="https://coinmarketcap.com/currencies/lido-dao/" target="_blank" rel="noreferrer noopener">$LDO</a>), a liquid staking solution. </li></ul>



<h3 class="wp-block-heading">TradFi</h3>



<ul class="wp-block-list" id="block-1209f037-00c3-4876-ad37-a29ab610c717"><li>China turns to <a href="https://www.reuters.com/world/asia-pacific/china-turns-stranded-australian-coal-combat-power-crunch-trade-2021-10-05/" target="_blank" rel="noreferrer noopener">abandoned coal mines</a> in Australia to combat coal shortages.</li><li>US ISM Sep services PMI data came in higher than expected at 61.9 vs. 61.7 in August. Yields on the 10-year treasury rose to <a href="https://www.cnbc.com/quotes/US10Y" target="_blank" rel="noreferrer noopener">1.534%</a> on the news. </li><li>US gas prices locked in their highest close in 12 years due to <a href="https://twitter.com/DeItaone/status/1445464140466704394?s=20" target="_blank" rel="noreferrer noopener">supply concerns</a>. </li></ul>



<h3 class="wp-block-heading">Insight</h3>



<p>“This month all eyes are on the SEC’s potential approval of a bitcoin ETF, and this is all the more relevant given two recent developments 一 at a conference last week, Gary Gensler reiterated his preference for a bitcoin futures ETF rather than one based on spot prices, which is relevant given that the proposals up for consideration this month are largely futures-based. Also, on Friday, the CME revealed that it was doubling the limits on initial BTC futures positions. Notably, the day that this new rule will come into effect is October 18th, the same day a decision by the SEC on the ProShares Bitcoin Futures Strategy ETF is due. This could be a coincidence, or it could be the CME planning for a potential surge in futures volumes,&#8221; said Noelle Acheson, Head of Market Insights at Genesis </p>



<h3 class="wp-block-heading">Bitcoin and Ethereum</h3>



<p>BTC dominance, or the percentage of the total crypto market capitalization BTC makes up, is up 5.16% over the last month. Historically speaking, rising BTC dominance sets the stage for alt coin rallies in the future. </p>



<div class="wp-block-image"><figure class="aligncenter size-full"><img loading="lazy" decoding="async" width="910" height="661" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png" alt="" class="wp-image-8975" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=910 910w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=354 354w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=359 359w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=301 301w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/BTC.D_2021-10-05_17-44-29.png?w=80 80w" sizes="(max-width: 910px) 100vw, 910px" /><figcaption>Source: Trading View</figcaption></figure></div>



<p>Perpetual funding rates for BTC are mixed across different exchanges, implying that traders are divided on whether to take a short or long position.  </p>



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="718" height="339" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png" alt="" class="wp-image-8978" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png?w=718 718w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-5.56.51-PM.png?w=80 80w" sizes="(max-width: 718px) 100vw, 718px" /><figcaption>Source: https://app.laevitas.ch/dashboard/btc/derivs</figcaption></figure>



<h3 class="wp-block-heading">Top 10 coins excluding stablecoins</h3>



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="362" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png" alt="" class="wp-image-8979" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/Screen-Shot-2021-10-05-at-6.00.16-PM-1024x362.png?w=1374 1374w" sizes="(max-width: 1024px) 100vw, 1024px" /><figcaption>Source: CoinMarketCap</figcaption></figure>



<ul class="wp-block-list"><li>Despite all of the turbulence in traditional financial markets, bitcoin has shown a lot of strength over the past week, last up more than 23%. This is a narrative bitcoin investors would like to see continue. There will be a decision on a futures-backed ETF this month which could be another catalyst for an end of year rally. </li><li>The poor performance of alternative layer-1&#8217;s tells us that money is rotating into the blue chips; BTC and ether. </li></ul>



<h3 class="wp-block-heading">Regulatory News</h3>



<ul class="wp-block-list" id="block-d64d70c9-7052-4f1a-8167-3d370fe08354"><li>Minnesota congressman, Tom Emmer, took to<a href="https://twitter.com/RepTomEmmer/status/1445461291145981958?s=20" target="_blank" rel="noreferrer noopener"> Twitter</a> to call out Gary Gensler for attempting to classify some digital assets as securities. He believes that would hurt retail investors more than it would help them. </li><li>Rep. Patrick McHenry (R-NC) introduced the <a href="https://republicans-financialservices.house.gov/news/documentsingle.aspx?DocumentID=408154" target="_blank" rel="noreferrer noopener">Clarity for Digital Tokens Act</a> today. This bill aims to keep innovation in the US and provide legal clarity to those involved with digital assets. </li><li>SEC chairman, Gary Gensler, echoed Jerome Powell&#8217;s comments that the US has no intentions <a href="https://www.bloomberg.com/news/articles/2021-10-05/sec-chief-signals-crypto-ban-like-china-s-won-t-happen-in-u-s" target="_blank" rel="noreferrer noopener">to ban crypto</a>. </li></ul>



<h3 class="wp-block-heading">What else we are looking out for&#8230;</h3>



<ul class="wp-block-list"><li>ADP employment numbers on Wednesday</li><li>Initial and continuing jobless claims on Thursday</li><li>Nonfarm payrolls, unemployment rate and average hourly earnings on Friday</li></ul>



<p>That is all for today. Let&#8217;s do this again same time tomorrow. </p>



<hr class="wp-block-separator"/>



<p><strong>Are you a UK or EU reader that can&#8217;t get enough investor-focused content on digital assets?<a target="_blank" href="https://cms.blockworks.co/events/das-london/" rel="noreferrer noopener">Join us</a>&nbsp;in London on November 15th and 16th for the Digital Asset Summit (DAS) London. Use code ARTICLE for £75 off your ticket.&nbsp;<a target="_blank" href="https://cms.blockworks.co/events/das-london/" rel="noreferrer noopener">Buy it now</a>.</strong></p>



<hr class="wp-block-separator"/>
