July 25, 2023: Conic Vivisection 🧑‍⚕️🚑

Where is the liquidity flowing in aftermath of the Conic Finance hack?

Last week we covered the unfortunate hack of Conic Finance.

Unfortunately, it turned out to just be the prelude to the story.

After the initial hack drained half of the ETH pool, it seemed as though the issue may be isolated to a reentrancy issue in the ETH pools. Business carried on as usual.

However, with Conic suddenly in the crosshairs, a separate attack vector was opened against Conic, this time targeting the much larger $crvUSD pool. The attack vector was a bit different, a variant of a sandwich attack. This attack was not able to drain funds quite as fast as the attack vector against the ETH pools.

As explained in the post-mortem:

Fortunately this attack was identified quickly thanks to the Curve Monitor Telegram channel. An alert went out on X (neé Twitter) to emergency withdraw from Conic Finance, and the team quickly halted all actions except withdrawals. In total, the second attack would drain about $934,000 from the omnipool, representing about a 2% loss to LPs.

Interestingly, MEV bots were active in siphoning off funds for themselves, so the attacker only netted about $300K for themselves.

Conic has since been in communication with the attacker, and according to one message, already seen some success.

This is another attempt to contact you regarding the Conic ETH pool exploit. One of the addresses involved in the crvUSD pool exploit already accepted a bounty of 10% of his profits and returned the funds (see tx 0xf56f34a092d8864549052d8a1072e8477a4fb45382ec9549a25c63bb566630b4). We sincerely hope that you will do what is right for everyone, and accept a similar offer so that we can all put this incident behind us. If we receive a positive reply within the next 24 hours, you can be sure that no law enforcement body will be contacted and that this will be treated as a white-hat hack. We are looking forward to receiving your reply.

Conic will quite likely repair the issue and relaunch operations at some point in the future, but this nonetheless remains quite a serious body blow to the protocol. About 80% of liquidity voluntarily left in the wake of the hack.

Meanwhile, the token price took about a 60% hit.

Perhaps the toughest pill to swallow is the intangible value of no longer being able to tie their fortunes to the ascent of $crvUSD. Serving as the majority destination for $crvUSD minters, Conic was on pace to see $crvUSD become its majority pool. Instead, any new minters will find other destinations.

$crvUSD Effects

The sudden withdrawal from Conic Finance of over $100MM of liquidity has had spillover effects onto Curve. Most notably, about 20% of the $crvUSD supply quickly disappeared, presumably users ragequitting the entire system in panic. The psychologically significant $100MM barrier was lost and will need to be recovered.

Remarkably, the volatility did nothing to damage the pristine $crvUSD peg.

With Conic Finance wounded, what’s the new destination for Conic Finance lockers?

Curve itself tagged four possible destinations.

Stake DAO has been showing off their strategies.

Similarly, Concentrator or Yearn would be easy choices for LPs looking to replicate the passive experience of staking into Conic.

Zunami has also been looking to reinforce confidence in the concept of omnipools

Surprisingly, though, after a cursory look of DefiLlama data, none of these protocols saw a bump in the amount one would expect if they were the beneficiary of a Curve diaspora (value changes in tens of millions). So, we’re not actually sure exactly where the liquidity ended up. If any researchers have time to research this Conic diaspora, please be in touch!