Partnered With:

25 million DAI can only be exchanged for assets worth 4,000 USD. Does Multichain have excess cross-chain DAI?

Read this article in 8 Minutes

Due to the complexity of its ecosystem, we have no way of knowing which users will be harmed by this.

Original author: bartek.eth

Original compilation: czgsws, BlockBeats

When users use cross-chain bridges, they must hope that the number of Tokens locked in the bridge is greater than the number of Tokens minted on the target chain. This is true for most bridges, but not all bridges, let's take a closer look at Multichain.

Multichain is a huge ecosystem that supports several chains and over 1000 Tokens.

Fantom was one of the first chains they supported, and generally considers Multichain minted tokens as their "standard" tokens.

Multichain uses Externally Owned Accounts (EOA) as bridge escrow accounts for their Each supported chain provides addresses individually. Fantom’s managed EOA is here, and you can see that the amount of Token held by this address is very large.

According to common sense, we can guess that the DAI minted on Fantom should be less than 74 million US dollars, but it turns out that there are more than 100 million US dollars of "wrapped-DAI-by-multichain-validators" Token (Ftmscan URL).

How is this possible? Apparently, either the cross-chain bridge validators minted the tokens out of thin air, or they removed the tokens from the bridge escrow account without burning “Fantom DAI” at the same time. It turned out to be the latter, as in a series of transactions in July 2021, the validator removed the token from the escrow account without a corresponding burn (Etherscan URL):

Don’t think about what happened to these Tokens for the time being, ideally, maybe the cross-chain bridge validator has re-mortgaged, oops In some cases, this could have been hacked without being noticed.

Tracking these funds is not an easy task given the complexity of the Multichain ecosystem, but the address receiving the token is now the only liquidity provider for AnyDAI, with $25 million of it on Ethereum.

Treat anyDAI as an IOU of DAI, Can be transferred to any chain supported by Multichain. Users can move it from chain A to chain B (using the burn-mint bridge), users can swap it for standard DAI, as long as there is enough liquidity.

How much liquidity is $25 million worth of anyDAI on Ethereum? There's only $4000, so $25 million in anyDAI is technically a "void IOU". (Etherscan URL)

So what happened to the DAI (and other Tokens) taken out of Escrow? They are used to “provide liquidity to other chains” by moving them through different escrow accounts and bridges, and minting various versions of DAI on the target chain.

What does this mean for the end user? If all the DAI withdrawn from the escrow account is indeed only used to provide liquidity, end users should be able to withdraw all their DAI provided 0x5e58 never converted their $25 million IOU into DAI.

Having said that, considering the number of chains, routers, anyToken versions, it is very important for this ecosystem A comprehensive audit of .

In addition, given that anyDAI is completely replaceable on all chains, if hackers An attack on the weakest chain in the system may affect wrapped Token holders and liquidity providers on other secure chains.

Finally, I believe that 0x5e58 will never convert their anyDAI, even if this is a validator wallet that can easily obtain Token from the cross-chain bridge, if Multichain users fully trust the validator...