Popsicle Finance Post Mortem- After Fragola Hack
This post is not something that we thought we would ever have to write and not something that is fun to announce, however as we know yesterday at 10:53 PM UTC time a hacker executed a transaction that managed to drain 85% of the Sorbetto Fragola (UniswapV3 Optimizer) pools.
This has only affected the Sorbetto Fragola contracts, other contracts such as nICE staking, ICE farming contracts and ICE token contracts are not affected.
Check out the Hackers Transaction here.
Funds lost:
What actually happened?
You can find the Transaction flow here.
In order to start the explanation let’s first explain how Fragola actually works.
- Funds from the user go straight to UniV3.
- Popsicle Liquidity Provider (PLP) shares are then given to the user.
- The contract is given info about the user, how much he put in, and states when he deposited.
- The contract checks the user's position and how much fees he has earned proportionally to the total pool.
- The contract gives out the fees based on the set parameters.
The hacker managed to exploit step 3), specifically the state function.
When users deposit tokens, it updates token0PerSharePaid and token1PerSharePaid, to keep track of the state that the user deposited the tokens into the specific Fragola pool. The reason for this is that it allows the contract to pay the user the fees from the direct state that he/she entered the pool.
The hacker made the contract believe that he earned as many fees as the total TVL of the pool and thus is entitled to the $20.7m that was in the pool. This hack was only possible because everything happened within one transaction (due to flashloan).
The hacker took all these captured coins and first swapped them for ETH on Uniswap, and thereafter put them through Tornado.Cash to launder them.
Sadly, neither we nor our 2 editors (Peckshield & Certik) noticed this bug.
For an in-depth look and analysis of the code, you can refer to this analysis by our friends @blocksecteam in the article here.
So, now what?
First of all, we would like to address the black hat hacker. Although this may be a long shot we are offering a completely clean $1,000,000 bounty paid in whatever currency he/she likes if funds are returned.
We are all working here in the new and exciting DeFi space, having people that find vulnerabilities is a part of the ecosystem, however in order to not scare people away we need to make sure they can trust the space. Returning the funds will show the strength of this crypto community.
@danielesesta @squirrelcrypto @popsiclefinance Twitter DMs are open to start the conversation.
What to do if you have LPd?
Deposits to all pools have been locked, the only pools available for withdrawal that have not been affected are the AXS/ETH, YGG/USDC, LINK/ETH, and all the EURt pools. Please withdraw any funds in these pools. These pools were most likely not affected as they just recently were added, as well as the LINK/ETH pool not having a significant TVL.
Now to address the lost funds:
Onto the lost funds, the individual team members have been large depositors to the Fragola pools, as in the end we built the product out of our own need. Thus we know how you as Isvikingers and Popsicle believers feel.
We have come up with some ideas for compensation, none of these are set in stone, we just wanted to spurt ideas. We will then in a few days announce and make a governance proposal for what we should do. Please take these with a grain of salt, as we haven’t had a sufficient amount of sleep.
For now, some ideas are:
- Increase Popsicle Protocol Fees from 10% to 15%, where 5% goes to the lost fund pool.
- Use the tokens that are still allocated to the team to stake as nICE and all the earnings from that paid to the lost fund pool.
- Issue a debt token.
- Use team & DAO funds as collateral to borrow money to pay back in a scaled way over the time frame of a year or more.
Again just to reiterate, these are only ideas, we as a team would like to take some time to really think about what the best way forward is.
Final Words
Lastly, we want to say a big thank you! The past hours have been really difficult for us, the Popsicle community has really come through in helping us out whether it’s on a moral or investigative level, we also have newborn moderators who stepped in with no question of doubt to help out with community management, so thanks klaudio97#4517 and MaxZon#2537!
We also got an incredible amount of DMs from all sorts of projects, individuals who have offered help wherever it is needed, the DeFi and crypto community is just something else!
DeFi is a very niche space that has seen incredible growth, and we are changing the way people will use financial products forever.
Just to remember how early we are, the first AMM was launched 3 years ago, the most capital efficient decentralized exchange ever, Uniswap V3, was only launched 3 months ago. We are all building incredibly innovative products, sadly in order to improve we sometimes have to fall. Or in other words, in order to build spaceships that travel to Mars, spaceships crash.
We however do not stop building until the spaceship is built and has landed.
The same way we at Popsicle Finance, will not stop building products in order to make everyone the market makers of this new financial system we all call DeFi.
For any additional questions, we will also be doing an AMA tomorrow, Thursday at 6:00 PM (UTC) on Popsicle Finance Twitter spaces.
Furthermore, if any new information becomes available, we will be sure to notify you all as quickly as possible, if you have any questions please also don’t hesitate to jump into our Discord Server.
