Summary
This post summarizes the actions taken by Idle Leagues to minimize risks related to the CRV exposure on Aave lending markets.
References
Background
Gauntlet risk assessment
On June 12th, the Gauntlet team shared a recommendation to freeze CRV and set CRV’s loan to value to 0 on Aave v2 in the Aave forum.
The risk profile of 0x7a16ff8270133f063aab6c9977183d9e72835428, had an HF of 1.66 and did not represent an immediate risk to Aave v2, but the proposal suggested reducing risk concentration. The account borrows roughly $67.7m of stablecoins ($67m USDT, $700k USDC) against $185m of CRV and $4m of TUSD.
Curve exploit
On July 30th, a series of exploits resulted in the loss of funds from several Curve pools. The source of the vulnerability in each case was a malfunctioning reentrancy lock in certain versions of Vyper (versions 0.2.15, 0.2.16, and 0.3.0).
The Table below, based on Llama Risk postmortem analysis, shows the affected pools, the amount extracted by each exploit and the USD value at the time of the exploit:
| Pool | Token stolen | $ token stolen | Exploit tx |
|---|---|---|---|
| pETH/ETH | 6,107 WETH | ~$11m | Link |
| msETH/ETH | 867 WETH and 960 msETH | ~$3.4m | Link |
| alETH/ETH | 7,259 WETH and 4,822 alETH | ~$22.6m | Link |
| CRV/ETH | 7,680 WETH, 2,880 ETH and 7,193,402 CRV | ~$24.7m | Link 1, 2 |
This hack significantly impacted CRV, down 10% in the past 48 hours, and raised concerns about the health of multiple on-chain loans: mainly on Aave and FraxLend. As an indirect consequence, utilization and rates skyrocketed during the weekend.
Actions
Idle Leagues in reaction to the Gauntlet proposal and suggestions (the related AIP-246 did not pass), decided to pause Aave v2 right after as an underlying market for the Senior DAI, USDC and USDT Best Yields vaults for precautionary reasons and to prevent further escalations of risks.
In light of the recent issues affecting CRV and indirectly Aave, the decision to pause Aave avoided automatic rebalances of BY funds to a lending market under stress and shielded users’ funds from excessive risk exposure.
A similar approach was held for Junior BY vaults on DAI, USDC and USDT where the Morpho-Aave underlying yield markets were paused.
Consequently, funds deposited into the DAI, USDC, and USDT BY vaults are currently allocated among the other underlying markets:
- Senior BY
: Compound and Clearpool Senior YTs - Junior BY
: Clearpool Junior YTs
Next steps
Leagues will continue to monitor how the CRV issue evolves and adjust promptly the Best Yield yield sources. If a more formal de-listing will be needed an official on-chain vote will be run.
