Partnered With:

The Pool Shark of Fantom: How big are the vulnerabilities? Can it save itself?

Read this article in 9 Minutes

Fantom ecosystem carries a deterministic shortfall of $56 million and a potential shortfall of $151 million.

Original Title: "The Disaster of Fantom's Pool Fish: How Big is the Vulnerability? Can it be Self-Rescued?"

Original Source: Star Daily

Due to the Multichain incident, Fantom has also been put in a dangerous situation.

Due to the fact that Fantom uses Multichain as the main cross-chain bridge in its ecosystem, the impact of the Multichain fund vulnerability (which saw $126 million flow out on July 7th, with approximately $118 million of assets being transferred from the Multichain Fantom bridging contract) has directly affected Fantom.

The most intuitive manifestation is that the stablecoins issued by contract bridging on Multichain on top of Fantom have significantly deviated from their pegs. According to SpookySwap, as of the time of writing, USDC-MULTI, fUSDT-MULTI, and DAI-MULTI (Multichain bridged stablecoins) are all priced at around 0.27 US dollars.

Although Fantom has frozen $62 million of funds through contacting stablecoin issuers such as Circle and Tether, due to nearly half of the $118 million hole being pure on-chain assets such as WETH and WBTC that cannot be frozen, it will be difficult to fill the $56 million gap in the short term through similar means.

In addition, given that Multichain recently disclosed in its official tweet that the sister of co-founder Zhaojun has also been missing, the subsequent transfer of approximately $151 million in assets to two EOA wallets (0x1eed63efba5f81d95bfe37d82c8e736b974f477b; 0x48bead89e696ee93b04913cb0006f35adb844537) on July 9 for asset preservation purposes also faces uncertainties. To put it another way, even if they do not lose control of the funds, it is likely to be difficult to handle the funds in the short term, so this portion of the funds can be temporarily considered a gap.

In short, the current situation is that the Fantom ecosystem carries a deterministic shortfall of 56 million US dollars and a potential shortfall of 151 million US dollars.

Harmony's Precedent

The current situation of Fantom can be traced back to Harmony a year ago.

In June 2022, Harmony's official cross-chain bridge, Horizon, was attacked by hackers, resulting in a loss of approximately $100 million. Although Harmony attempted various methods to recover the funds, ultimately they were unsuccessful.

Due to the fact that the stablecoins on the Harmony chain are mainly issued through the Horizon bridging contract, there has been a significant problem of being unanchored. This is similar to the current situation on Fantom, and perhaps it is slightly "fortunate" that, compared to Harmony's own mistakes and direct responsibility for compensation, Fantom can only be considered an indirect responsible party outside of Multichain this time.

But speaking of which, Fantom chose Multichain as the main cross-chain bridge, which puts the security of the ecosystem in danger (Zhaojun's personal server), and this choice itself is worth discussing.

The de-anchoring of stablecoins does not only mean losses on the holders' balance sheets. From an ecological perspective, the failure of their utility will inevitably have a negative impact on the development of ecological projects.

The most intuitive manifestation is that the operation of some projects will be forced to suffer huge impacts, especially lending agreements. Due to the fact that the stablecoin's unanchoring almost always happens in an instant in such events, it is difficult to execute effective liquidation in lending agreements, resulting in huge bad debts. Aave on the Harmony chain has not yet resumed normal operation, and Geist Finance, the largest lending agreement on Fantom, has also announced permanent closure.

However, the more implicit yet more intuitive impact is that the inability to solve vulnerabilities is a blow to the confidence of all projects within the ecosystem, which is almost tantamount to slow death. In the past year, we have seen too many projects migrate from Harmony, and similar situations may also occur on Fantom.

Can the vulnerability be resolved? What is the lesson?

Of course, for Fantom, filling the gap is quite difficult, but it is not impossible. Not to mention that the control of the two EOA wallets is still unclear, just from Fantom's own financial situation (refer to "AC's Account of Fantom's Financial History: From Surviving on 2 Million Dollars to Holding 1.5 Billion Dollars"), AC once stated that in November 2022, Fantom's treasury held over 450 million FTM, 100 million US dollars in stablecoins, 100 million US dollars in encrypted assets, and 50 million US dollars in non-encrypted assets.

From an absolute numerical perspective, the reserve funds of the Fantom treasury are sufficient to cover this vulnerability. However, it is currently unknown whether the situation will lead to Fantom utilizing the treasury, and what the community's stance on this matter is.

Considering the recent Fantom incident and even earlier Harmony incident, we can see that "cross-chain dragging down public chains" is no longer an isolated case, but has shown a certain degree of universal risk. From the perspective of public chains, in order to avoid such incidents from happening again, we can only minimize the systemic impact of cross-chain bridges on the overall operation of the ecosystem as much as possible.

There may be several potential solutions at different levels: First, the public chain can incubate native stablecoins, which will minimize external risk transmission but also pose the greatest difficulty; second, collaborate with stablecoin issuers such as Circle and Tether to issue native USDC and USDT on their own chain, which is currently the most popular option but also requires comprehensive development and business cooperation strength of the public chain; third, perhaps it is possible to minimize reliance on a single cross-chain bridge and balance the amount of stablecoins issued by each bridging contract through incentive and other regulatory measures.

In summary, cross-chain bridges, as the biggest risk source (perhaps without exception) in the on-chain ecosystem, should maintain sufficient security vigilance in combination with their various hierarchical components. We hope that Fantom can successfully overcome these challenges and that similar incidents will not happen again.