April 4, 2021: Unforced Error ⚾️😳
The ForceDAO giveaway continues, in a manner of speaking...
Remember ForceDAO? Just last month Curve users thought they’d stumbled upon El Dorado — una ciudad legendaria de oro. Trade in your beef bouillon for gold bullions, we’re eating out on town tonight!
Well, this morning we found out what happens when an unmovable hacker meets a highly stoppable Force.
Look through the following function. Even if you can’t code you can still follow the logic here. Imagine calling this function and asking for xForce, but you don’t have any Force. In other words, force.balanceOf(msg.sender) == 0
Well, there’s no such check for anything that. It’s an ATM that doesn’t bother reading your card… it’s open season!
Fortunately, for the Force team, the hack could have been much worse. The exploit was discovered by a white hat hacker, who drained about $10MM worth of $Force.
Two other users managed to swipe about $250K, but they used addresses associated with Binance and FTX, making it possible they funds may yet be recovered.
Trading was halted, albeit in a sort of “does the unheard tree falling make a sound” type of manner.
Within the world of DeFi hacks, this one was too small to really impress. Millions of dollars sitting in the middle of Times Square, and 98% stays safe? That’s more like a bug bounty, when what DeFi fans really wanted was fireworks.
Indeed, even before the hack, users were already salty about the free money being handed out by Force.
Most users got about $100-$200, making it not worth the gas to claim.
At the moment DeFi is so flush with cash that beggars can afford to be choosers. A few hundred dollars buys your project nothing but discontent among the malcontents. If you want to get the masses excited, don’t just give away money, get people some free spins at the wheel to get the gambling juices flowing.
For instance, consider the much lauded Ellipsis Finance giveaway. The benevolent Curve fork’s giveaway has been received very positively; not only buying goodwill but converting longtime BSC skeptics into power users. Over 80% of the first two airdrops have been already claimed
Claiming $EPS instantly destroys 50% the airdrop’s $EPS value, but with an APY currently sitting at >2000% degens are gambling that this would pay itself back in just two weeks. This is plenty long enough to grab the attention of the wider degen community and shoot Ellipsis Finance to the top of the leaderboards.
Of course, much of this APY is likely being driven directly by people making these claims. This 50% burn simply gets reshuffled amongst everybody and labeled as earnings. You get your free money back, maybe more, maybe less. But can you really put a price on endorphins?
For more info, check our live market data at https://curvemarketcap.com/ or our subscribe to our daily newsletter at https://curve.substack.com/. Nothing in our newsletter can be construed as financial advice. Author is a Curve maximalist, but has no interest in ForceDAO.