Partnered With:

Is there no way out for Curve in the face of crisis? A perspective from DeFi mining on response strategies.

Read this article in 12 Minutes

Currently, many DeFi asset management teams and individual DeFi whales are using Cobo Argus to improve DeFi efficiency and strengthen asset security protection.

Original author: Luke (DeFi enthusiast, Cobo Argus product manager)

DeFi world is in crisis these days due to the latest attack suffered by Curve. Since the attack on July 30th, the price of CRV has plummeted from 0.74 USDT to below 0.5 USDT, with a slight rebound today and currently stable above 0.6 USDT. Although it has been determined that this attack was caused by a bug in the old version of the Ethereum programming language Vyper, the crisis facing Curve has not yet been resolved.

Due to the founder of Curve holding a large amount of CRV for on-chain collateralized borrowing and lending, if the price continues to drop, it could lead to a large amount of CRV being liquidated, causing a chain reaction of forced liquidations and potentially resulting in the CRV price dropping to zero. As one of the largest protocols in the DeFi space, the latest crisis faced by Curve has once again dealt a significant blow to the security and credibility of DeFi, which could have many adverse effects on its future development.

Here, the author only discusses from the perspective of miners participating in DeFi mining, how to prevent potential risks in daily DeFi mining, and what feasible solutions and tools can be used.

Background of the Event

Firstly, let's briefly review the process of the Curve crisis through a timeline.

On July 30th at 21:34, the pETH-ETH pool on Curve was attacked, causing the pETH price to drop to $383. At 22:50, the msETH-ETH pool on Curve was also attacked. And at 23:34, the alETH-ETH pool on Curve was attacked as well.

On July 31st at 0:44, Vyper, the programming language for Ethereum, tweeted that the reentrancy bug in versions 0.2.15, 0.2.16, and 0.3.0 of Vyper has been fixed.

At 0:45, Curve tweeted that due to a reentrancy bug, the stablecoin pools (alETH/msETH/pETH) using Vyper 0.2.15 were attacked, while the other pools remain safe.

16:41 Curve tweeted, suggesting that everyone remove liquidity from the Tricrypto pool on Arb. Although it has not been attacked, the pool may also be at risk.

Due to the attack on Curve and the numerous abnormal events on the chain, the price of CRV has plummeted, causing panic that mich's lending position may be liquidated and leading users to withdraw liquidity from Aave, resulting in unusually high interest rates for USDC and USDT. The DeFi world is being drawn into a series of associated risks.

Reason Analysis

The particularity of this security incident is that it is a bug at the smart contract language level, which caused the failure of re-entry lock defense in some well-known projects. Fortunately, it is Vyper rather than Solidity that has the problem, otherwise the entire DeFi world may be in danger.

Euler, Curve and other well-established protocols have experienced major failures, which has indeed caused many DeFi believers to lose confidence. Once a protocol has problems, it often results in the loss of the entire principal. In addition to smart contract risks, there are also phishing risks, private key leakage risks, etc. How to achieve both security and efficiency when participating in DeFi has always been a difficult problem in the industry.

The Cobo team has been active in the DeFi field for a long time and is known for its emphasis on security. Within Cobo, there is an internal solution for various DeFi security issues. The Cobo team has now productized this internal solution and launched Cobo Argus, a solution for the DeFi scene, which quickly reached a TVL of $100 million after the new version went live.

Response Strategy

Regarding events like the one that occurred with Curve last night, it is almost impossible to prevent them beforehand. For general DeFi miners, the only option is to try and detect the problem as soon as possible and take appropriate measures. In such cases, tools like Cobo Argus can be extremely helpful if used properly. Cobo Argus provides a withdrawal robot function that monitors risk indicators on the chain and helps users withdraw as soon as anomalies occur.

For the following situation regarding Curve, let's analyze how to use the withdrawal robot on Cobo Argus:

1. There has been a significant decoupling of assets tied to hooks.

2. Due to hacker attacks and large-scale withdrawals, there has been a significant decrease in TVL.

Generally speaking, most users only learn about the risks of DeFi protocols through warnings from white hat hackers on Twitter. By this time, several hours may have passed since the attack occurred, and there may no longer be an opportunity to save their principal.

By using robots to monitor the risk indicators on the chain, users can be effectively protected by automatically withdrawing their assets at the first sign of risk.

Hacker attacks, token decoupling, loan protocol runs... Various on-chain risk events can be monitored through specific indicators. Cobo Argus also allows users to set up custom robots, customize monitoring indicators, and trigger contract calls after the robot is triggered.

For expert-level users with good knowledge of DeFi, they can set their own monitoring values and robot actions, theoretically allowing them to use any DeFi protocol. In the Cobo Arugs community, there have recently been users who have saved their assets from a lending protocol by customizing their own robot.

All of these functions are decentralized and trustless - the robots are operated by Cobo, but they can only perform DeFi operations that are authorized by the user and cannot perform any unauthorized operations. All authorizations are recorded in an immutable smart contract, and the contract's code and authorization records are completely transparent on the chain and can be audited by anyone.

Just to add some more information, Cobo Argus's smart contract is based on the Plugin feature of Safe{Wallet}. Safe{Wallet} is the largest and most secure multi-signature wallet in the Ethereum ecosystem, with the highest TVL. Most DeFi protocols use Safe{Wallet} to manage their treasuries. Plugin is the latest capability introduced by Safe{Wallet}, which allows third-party developers to extend the capabilities of Safe{Wallet} by writing Plugins.

Cobo has always had close ties with the Safe{Wallet} team and developed Cobo Argus in the early stages of Plugin capability. They have also launched a series of solutions tailored to the DeFi scene based on Safe{Wallet}.

DeFi Authorization

You can authorize specific DeFi protocol operation permissions to a wallet for single signature execution. Although using Safe{Wallet} and hardware wallets is relatively secure, the process is inefficient and cumbersome, and is not suitable for frequent DeFi operations. Especially when DeFi protocol black swan events occur, this inefficient and cumbersome process can be fatal.

By granting specific permissions to a single address for execution, efficiency can be improved without compromising security. This address can only perform the authorized specific operations and cannot perform unauthorized operations or transfer funds.

By using the authorization function of Cobo Argus, you can avoid situations such as phishing attacks, accidental loss of funds due to hot wallet private key leaks, and internal team members misusing and transferring funds.

DeFi Robot

Cobo Argus has launched a robot feature based on DeFi authorization, which allows users to authorize specific DeFi protocol permissions to the robot for automated operations such as automatic reward claiming, selling and reinvesting, and automatic withdrawal.

Currently, Cobo Argus has been widely adopted by many DeFi asset management teams and individual DeFi whales, not only improving the efficiency of DeFi, but also enhancing asset security protection. Recently, projects such as Solv and Izumi have also used Cobo Argus as the underlying decentralized and secure tool. In the future, Cobo will continue to innovate, protecting ordinary users and builders in the industry, and promoting innovation and progress in the industry.

Finally, DeFi still has infinite potential in the long run, but potential risks cannot be avoided in DeFi mining. We hope everyone will participate cautiously. "If you want to do a good job, you must first sharpen your tools." DeFi miners can also make good use of tools to deal with different risks as much as possible while increasing vigilance and accumulating experience.