August 30, 2021: Rug or Bug? 🪳⚖️
Judging malfeasance among Curve, Sushi, CREAM, EIP-1559 + more
Crypto’s a dangerous place. When you’re aping at the bleeding edge of technology, you’re bound to run up against various coding flaws. Are they bugs or rugs?
Let’s review the latest issues and judge whether they are innocent mistakes or malicious attacks.
POLYGON TRICRYPTO
An issue was reported on Curve Polygon TriCrypto, with users encouraged to migrate:
Tough call — Curve has yet to rug people en masse. Nor does Curve tend to have bugs.
TriCrypto is still first-of-its-kind technology though, with no particular way to test but to deploy into prod. We’ve not yet seen full details of the issue, so we’re purely speculating here. Since no users lost money and Curve put up a nice interface to help users migrate, we’re fairly certain it’s not a rug.
VERDICT: BUG
SUSHI MISO VULNERABILITY
This announcement turned people’s heads:
The write-up of the vulnerability is a gripping read of how he identified and exploited the vulnerability in the span of just half an hour. The exploit allowed for wiring some ETH to the `batch` endpoint. This endpoint ran a loop that checked the value of ETH exceeded a minimum, but re-used this for each step of the loop. The same ETH could be used to bid on multiple contracts. Then, the exploiter simply needed to lose these bids to claim multiple refunds with their single bid. This could have drained $350MM!
A million dollar bounty is quite a nice haul, albeit less than a percent of the overall opportunity. Since an intentional exploit could have been worth so much more, this doesn’t smell like a rug.
VERDICT: BUG
CREAM RE-ENTRANCY
Nearly 418,311,571 $AMP and 1300 ETH drained from CREAM in the form of a flash loan re-entrancy attack.
The initial value of the hack was $25MM, but after the prices of the tokens dropped it’s down to around $19MM. The $AMP token price dropped the most (-30%), even though early blame is being tossed towards the $CREAM team (-6%).
It’s too early for a post-mortem. If the fault was indeed with the CREAM code, it would be the second major exploit in six months. When a protocol gets hacked twice, it becomes a bit more suspect. By some indications, it may have even been a bug auditors actually caught ahead of time:
VERDICT: TOO EARLY TO SAY
CURVE VOTES 63-72
The payload for a few Curve votes were borked.
Governance shenanigans are a terrible thing, just ask any $UNI holder. In this case, the issues and replacements are being disclosed with full transparency. No funds or obvious attack vector. Nobody appears to be crying foul. Jimmy Carter’s sleeping peacefully.
VERDICT: BUG
NFT Censorship
Centralized companies are prohibiting access to charity.
That’s approaching cartoon villain levels of evil.
VERDICT: RUG
GREEDEN-GETH
A clever new repository to allow miners to switch between whichever block nets them the most profit.
It’s a machine for efficiently transferring money from the pockets of users to miners. Pretty clearly an intentional rugging built into the base layer of Ethereum, and a genius one at that.
VERDICT: RUG
EIP-1559
With gas prices hovering in high double digits, Ethereum is becoming unusable for plebs once again.
The effect of EIP-1559 is a complicated issue, which we dove into some last week. Certainly gas prices are very high, yet we still see experts presenting complex models for why it’s in fact a good thing.
There is an element of caveat emptor. Nobody who read the fine print expected EIP-1559 would lower gas fees.
It’s a tough call here. On balance, we’re still supportive of EIP-1559. The transactions run so quickly and easily when sent using a supportive protocol like Brownie. It’s clearly a necessary step for scaling. Our heaviest criticism is reserved for wallets like MetaMask, which were still pushing legacy transactions well after EIP-1559 was enabled.
Nonetheless, we observe that common plebs did not have a good understanding of EIP-1559. Too many non-technical users held onto the erroneous belief that it would have the effect of lowering gas fees. The overly technical explanations clearly misled people, and too little work was put into correcting these misconceptions. Further, while it was by no means the onus of the dev team to get the community onboard, they could nonetheless have eased the transition by delaying rollout until most major wallets had support. Additionally, a pattern is starting to develop: every major change tends to redound to the benefit of increasing miner revenue.
VERDICT: RUG
For more info, check our live market data at https://curvemarketcap.com/ or our subscribe to our daily newsletter at https://curve.substack.com/. Nothing in our newsletter can be construed as financial advice. Author is a $CRV maximalist and owns some $ETH and has a position in Curve’s Ironbank pool.