Loans, Buy Walls, and OTC Deals: The Curve Finance Exploit

Rekt and Llama Risk have done a nice job breaking down the technical aspects of the exploit. For our purposes it’s most important to know that three Curve pools – alETH-ETH, pETH-ETH, and CRV-ETH – were drained of about $70mn worth of tokens and that the exploiter currently holds over 7mn CRV tokens. 

In the grand scheme of DeFi exploits this one was relatively small – about 10 times smaller than the largest ever. What makes it interesting is its effect on Egorov’s loans and various DeFi protocols. I covered the loans in-depth in a Deep Dive a few weeks ago, and I recommend reading it before this for background. This Deep Dive will cover the exploit, the fallout, and what might happen next.

the exploit

Focusing on the CRV-ETH pool, the exploit looked like this:

The attacker deposited 400 ETH (the single positive orange circle) and withdrew millions of dollars worth of tokens in a single transaction. It’s shown as numerous orange circles above because the tokens were removed in about 60 clips within a single transaction.

With the vast majority of liquidity removed from its largest on-chain liquidity source, CRV’s price quickly fell below $0.10 on Curve and below $0.25 on Uniswap.

Importantly, however, CEX prices remained stable, allowing oracles to filter out divergent prices and preventing Egorov’s loans from being liquidated.

fallout

Almost immediately after the exploit was spotted CRV’s open interest (OI) began to climb, doubling from $30mn to $60mn in just six hours. As OI began a second leg up, the volume weighted funding rate (VWFR) dropped from slightly positive to -0.08%, then to -0.25%, a sign that there was heavy shorting.

As the implications of Egorov’s potential liquidation became clearer (this is also discussed in the aforementioned Deep Dive), AAVE’s funding rate turned negative as OI climbed from $35mn to a high of $50mn. 

However, the most interesting activity came in spot markets. Normally following an exploit, we see liquidity drop as a token’s price falls and market makers reduce exposure amidst uncertainty. This time, we saw the opposite.

Bid depth within 0.5% of the mid price was volatile, but there was a clear trend further from the mid price. Bids within 4% doubled from $1.5mn to $3mn, with Binance accounting for about $1mn of this surge. Such a significant surge concentrated on a single exchange suggests that a party or parties were putting up buy walls for CRV.

On-chain, $500mn worth of tokens were withdrawn from Aave V2 in just 3 hours. Excluding two very large flash loans (each depositing $200mn to profit just 0.4 ETH), about $2bn has been withdrawn from the protocol while $1bn has been deposited.

As a result of these outflows, Aave V2’s USDT and USDC borrow rates jumped from under 4% and are currently resting between 13% and 18%. Egorov is currently borrowing $50mn USDT from Aave V2; higher interest rates are not helping the health of his loan.

dead reckoning

What happens next is unclear, but Egorov has already taken some clever measures to prevent liquidation. As we’ve written in the past, Curve is favored by whales, with an average trade size many multiples higher than on Uniswap. Its close relationship to whales – and earned respect amongst the Ethereum builder crowd – seems to have come in handy as Egorov has been selling off millions of CRV in OTC transactions at $0.40, including to Justin Sun, Yearn Finance, and Stake DAO. Aave governance is currently considering whether to buy 5mn CRV tokens. This is a win-win arrangement where Egorov gets much needed stablecoins and OTC buyers get cheaper CRV while also reducing the likelihood of broader DeFi contagion.

This fresh liquidity coincided with his reducing the size of the Aave V2 loan on Wednesday morning, repaying about $9mn of USDT and withdrawing about $22mn of CRV.

However, Egorov’s Fraxlend loan, which was about $15mn FRAX last month, carries the highest interest rate because of a unique multiplier mechanism. To combat this, Egorov created a fFRAX-crvUSD Curve pool, then incentivized the pool with CRV tokens. fFRAX is a token generated by depositing FRAX on Fraxlend. Thus, the creation of this heavily incentivized pool encouraged users to deposit FRAX on Fraxlend then deposit the fFRAX – paired with crvUSD – on Curve. This had the intended effect of increasing FRAX deposits, thus lowering utilization and decreasing Egorov’s interest rate. This has bought him some time to pay off the loan before its size grows significantly. 

This got a new wrinkle when Abracadabra – where Egorov has borrowed $10mn MIM – proposed significantly increasing interest rates, though this proposal appears to have failed as of this writing. Essentially, lending and borrowing protocols are jockeying to get repaid first. Fraxlend appears to be in the lead because of its high interest rate, though this could change quickly. 

Protocols getting saddled with bad debt was always likely with loans of this size backed by illiquid tokens. However, bad debt would be a virtual certainty now given that most on-chain CRV liquidity is gone. Most concerning is that the exploiter holds 7mn CRV tokens and thus significant leverage over CRV’s price.