Curve narrowly escaped from its predicament, but the industry still needs reflection.

Curve narrowly escaped its predicament, but the industry still needs reflection.

Source: Coindesk; Author: LianGuaiBitpushNews Mary Liu

After a series of side deals between the founder and the top participants in the crypto industry, the worst consequences of the Curve exchange hack seem to have been avoided.

However, these events are still accusations against the popular narrative of decentralized finance (DeFi) – centralized platforms are vulnerable to greed and poor risk management, while decentralized platforms continue to progress. It turns out that DeFi is also easily affected.

Curve is an important decentralized exchange on the Ethereum blockchain. Last month, it was attacked by hackers, resulting in a loss of over 70 million US dollars. After the exploit was utilized, the price of the exchange’s native token CRV immediately dropped by more than 20%.

• Bankless Security Guide – 10 Key Steps to Protecting On-Chain Assets
• Account Abstraction (AA) The Future Web3 Wallet Experience
• LianGuaiWeb3.0 Daily | Binance Labs announces strategic investment in AltLayer

This incident has raised concerns about the security and survival of Curve. Among many competitors with poor reputations, Curve is widely regarded as a “blue-chip” cryptocurrency exchange. This hack also drew attention to Curve founder Michael Egorov’s high-risk loan position, where he used 33% of the CRV supply for personal loans. If the price of CRV drops low enough, the collateral may be automatically liquidated by DeFi lending platforms and dumped onto the open market, causing a decline in the price of systemically important DeFi assets.

Curve offered a 10% reward to the attacker in exchange for the return of the funds, and the platform has successfully recovered nearly 75% of the assets lost in the attack. With the founder of Curve repaying part of the loan, the price of CRV has also experienced a slight rebound in the past week, indicating that the risk of his large CRV package being liquidated is lower than the risk after the hack.

However, the Curve incident still serves as a warning signal for one of the largest cryptocurrency trading platforms and the entire DeFi ecosystem.

First, what is Curve?

Curve was launched in 2020 and is a decentralized exchange (DEX) on the Ethereum blockchain.

At a higher level, the platform works similarly to other DEXs like Uniswap, allowing people to exchange cryptocurrencies without intermediaries. Like many other DEXs, anyone can deposit cryptocurrencies into Curve’s “pools” – various types of cryptocurrencies. Other traders use these pools to exchange tokens, and the token prices are determined by the proportions of different assets in the given pool. Pool participants, known as “liquidity providers (LPs),” earn a portion of the transaction fees.

Compared to Uniswap and most other exchanges, Curve is specifically designed for trading stablecoins and other similar assets (digital tokens pegged to the price of other assets). During the DeFi bull market in 2020-21, Curve was once the largest DEX in terms of trading volume, accumulating over $20 billion in liquidity at its peak.

Why is CRV so important?

In addition to focusing on similar assets, the main feature of Curve’s vibrant growth in the last cryptocurrency bull market was the platform’s incentive structure based on CRV.

Curve rewards liquidity providers by incentivizing them to deposit funds into their pools with CRV tokens, in addition to the regular interest generated from transaction fees. The platform offers further rewards to users who are willing to lock CRV in exchange for veCRV (another form of reward). CRV can be locked for multiple years, and the longer the lock-up period, the greater the veCRV reward.

VeCRV also serves as a voting mechanism in the Curve system, meaning it can be used to influence how Curve distributes rewards to different pools. The pursuit of veCRV has led to the “Curve Wars,” where people compete to accumulate veCRV tokens to direct rewards towards their preferred pools.

Curve Wars make CRV and veCRV systemically important in the wider DeFi ecosystem. These tokens are widely used for lending, collected by crypto platforms to enhance liquidity in their Curve pools, and they provide support for various derivative platforms, such as Convex, specifically built to leverage the Curve reward system.

Beware of incentive games

In recent months, as the bear market has eroded the price of CRV, Curve’s dominance has gradually weakened, allowing new competitors like Uniswap V3 to capture a portion of the platform’s market share. According to DefiLlama, Curve currently has $2.4 billion in deposits, only one-tenth of its peak of $24 billion in 2022.

The price of CRV has also dropped to $0.60, lower than the peak of around $6 in 2022, declining 20% since last month’s hack attack.

Sid Powell, CEO of Maple Finance, said, “I think Curve will now have problems due to the post-criticism of the Curve token.” Maple Finance is a blockchain-based credit market that provides DeFi services to institutions and accredited investors.

The long-term viability of Curve’s CRV reward program – a relic of the early days of DeFi where issuing tokens as a form of money printing was the preferred mode of attracting users – seems uncertain now given the price of CRV. Sid Powell referred to this system as “Ponzi economics.”

Sid Powell said, “It’s a bit like an iceberg melting, they have to find some way to increase or recreate the utility of CRV.” “Otherwise, having it doesn’t make sense,” as using Curve’s rewards without CRV (purely generated from transaction fees) would be insignificant compared to the returns users get from CRV bonuses.

“I’m watching the second-order effects of Curve TVL (Total Value Locked) and the number of protocols built on Curve TVL,” he added. “What will happen to Convex if the CRV token rewards are removed or become worthless?”

CoinDesk attempted to consult Curve founder Egorov on this matter but was unsuccessful.

“Blue-chip” does not mean foolproof

Over time, Curve has gained a reputation as a “blue-chip” decentralized exchange – one of the relatively few secure protocols among many flawed ones. Its design is relatively simple and until July, it was one of the few major DeFi platforms to avoid major hacking attacks.

The Curve vulnerability reminds us that scale does not equal security.

Last month’s attack was caused by an error in the Vyper compiler, a programming language similar to Solidity that allows people to write smart contracts. A specific vulnerability in the Vyper code, known as a reentrancy attack, allowed hackers to repeatedly extract funds from Curve without the protocol realizing it had sent the funds.

While Curve is well-known, the same cannot be said for Vyper. The vulnerability in Vyper has raised concerns about how attackers can potentially disrupt decentralized systems through various means, and as the code supporting DeFi platforms becomes more complex, the risks may only increase.

Decentralized protocols and centralized token supply

In the months leading up to the July incident, Egorov borrowed a loan worth approximately $100 million. As collateral, he used approximately $200 million worth of CRV – accounting for 33% of the total CRV supply.

If the price of CRV falls low enough, Egorov’s position will be liquidated, meaning his collateral will be dumped onto the market. This could trigger a full collapse of CRV, which has relatively low liquidity but is still systemically important to DeFi.

Experts say it should be noted that founders of “blue-chip” decentralized financial protocols are able to accumulate over one-third of the native token supply and then use it as collateral to support loans worth millions of dollars, as it has potential implications for the protocol and the entire DeFi ecosystem.

Sid Powell said, “I wouldn’t necessarily call it unethical, but it does come with risks – as you can see – and the risks are not hard to predict.” “If you have a $100 million loan, and you have leverage and it’s against your token, your token’s price might drop, and you need to liquidate it to cover your losses.”

DeFi does not offer complete transparency

Egorov mitigated the risk of the loan position by repaying a portion of the loan, lowering the liquidation price of CRV. However, he needed to engage in over-the-counter transactions with “whales” such as Tron blockchain founder Justin Sun to provide funds for these payments.

It is not the first time that major companies like Tron have intervened to prevent a cryptocurrency collapse. This serves as a reminder, after several similar incidents, that the power in decentralized finance is held by a small number of participants – a situation not dissimilar to traditional finance.

Analyst Daniel Kuhn said, “The dream of pushing DeFi forward, decoupling money from power, and easily accessing basic and complex financial products without fear or bias has died.”

In response to Kuhn’s column, Adam Blumberg pointed out that blockchain technology does allow people to have real-time visibility into Egorov’s loan positions – a transparency that is only possible in the decentralized financial world, where transactions and wallet addresses are implemented. All are publicly visible. However, the comprehensive influence of figures like Justin Sun remains opaque, and as whales become more sophisticated in obfuscating their holding sizes, this influence will only grow.

Cryptocurrency analysis firm The TIE strategy analyst Sacha Ghebali said, “On-chain transactions do not necessarily represent the asset risks that underlying traders have. This is no different from traditional financial markets, where at times the transparency that these systems can achieve is limited, even if the impression given is that it is transparent.”

We will continue to update Blocking; if you have any questions or suggestions, please contact us!