In the early hours of July 31, the smart contract programming language Vyper announced on Twitter that the anti-reentrancy locks in versions 0.2.15, 0.2.16, and 0.3.0 have failed. Malicious actors took advantage of this vulnerability to repeatedly re-sign contracts, leading to unauthorized operations or fund theft. Several significant projects, including Curve Finance, were attacked, with an estimated total of $70 million being exploited. Some of the funds are held by white hat hackers and MEV bots and may be recovered.
Four liquidity pools in the Curve ecosystem—CRV/ETH, alETH/ETH, msETH/ETH, and pETH/ETH—were attacked, resulting in a loss of over $45 million in liquidity from lending protocols such as Alchemix, synthetic asset Metronome, and NFT lending platform JPEG'd. Approximately $25 million was drained from the CRV/ETH pool. Another pool that might be affected is the Arbitrum Tricrypto pool, but auditors and Vyper developers have not identified any exploitable vulnerabilities.
Furthermore, according to DefiLlama data, the Total Value Locked (TVL) in Curve Finance dropped from $3.266 billion on July 30 to $1.869 billion, marking a 42.78% decrease within 24 hours.
Debt Crisis Triggered by Curve Founder
Based on DeFiLlama data, if the CRV price falls to $0.36 or lower, Curve founder Michael Egorov has borrowed a substantial amount of stablecoins using his CRV as collateral in various lending protocols. He has already repaid over $17 million in stablecoin loans, slightly improving the health of his debts. However, the DeFi founder still faces a massive debt burden, including $60 million in Aave stablecoin loans, $12 million in Abracadabra stablecoin loans, and approximately $8 million in Inverse stablecoin loans. Additionally, Egorov has a $9 million loan on Frax with an 85% interest rate.
Significant Impact of CRV Liquidation
Curve founder Michael Egorov has collateralized around 34% of the total CRV token supply, borrowing stablecoins worth $63 million on the Aave lending protocol alone. He has also lent out up to 460 million CRV tokens, representing 47% of the total supply, in exchange for $110 million. If the CRV token drops below a certain price (approximately $0.35), it will trigger an automatic sale of Michael Egorov's loan collateral. This could lead to a vicious cycle of continuously decreasing CRV prices, forcing other loans into liquidation and potentially sending CRV into a death spiral. CRV is widely used as collateral in the DeFi ecosystem, and a significant drop in its price could paralyze the entire DeFi industry.
Self-Rescue Efforts by Curve Founder
Curve founder Michael Egorov has initiated self-rescue efforts, repaying some of the loans and reclaiming CRV used as collateral, which he then sells to raise funds. He has been doing this in a continuous cycle. Perhaps due to insufficient market liquidity and fear of extreme price impact, Egorov chose to conduct these transactions through over-the-counter (OTC) trades, with a fixed price of $0.4 per CRV. As of the time of writing, the market price of CRV is $0.56. Many investors and institutions participated in discounted CRV purchases. It should be noted that CRV sold by Michael Egorov through OTC trades has a six-month lock-up period, so while it is discounted, it may not have an immediate significant impact on the secondary market.
Summary
As of now, the crisis surrounding Curve is far from over. Despite some improvement in the health ratio of CRV loan positions and the recovery of certain levels, the high debt burden and the trust crisis from the attack continue to pose a fatal threat to the CRV price.
In addition, Vyper, as the second most popular smart contract programming language, is like Solidity, another programming language designed for smart contracts that can be compiled into bytecode and run on the Ethereum Virtual Machine (EVM). However, its vulnerability to attacks has had a significant impact on the entire DeFi industry.
For more analysis, please follow Aibit's media account for real-time updates! This article is for reference only, does not represent any position, and is not intended as investment advice. Investment is risky, caution should be exercised.
Website: www.aibit.com
Facebook: https://www.facebook.com/aibitcom
X: https://twitter.com/aibitcom
Telegram (CN): https://t.me/aibitcom_cn
Telegram (EN): https://t.me/aibitcom
Telegram (Announcements): https://t.me/aibitcom_announcements
Discord: https://discord.com/invite/aibitcom
Medium: https://medium.com/@aibitcom
Youtube: https://www.youtube.com/@aibitcom