There is only one person with liquidity on Spectrum. To have them not lose their ERGs in liquidity they need to withdraw before we send refund ERGs. Furthermore, anyone with hodlErgs in contracts might be problematic.
From Bruno Woltzenlogel Paleo (@Ceilican)
Hi everyone. We (@kushti_ru @Pulsarzz @ceilican) spent the last several hours investigating what happened. We have discovered how the vulnerability found its way to the contract. We have implemented a fix. And we have implemented tests to ensure that the fix works.
To know more, please read on.
From the start, we worked hard to try to ensure that the contract was vulnerability-free. This is visible in our commit history. Almost every commit there makes the code simpler and easier to understand, so that it would be easier for us or anybody else to reason about the code, instead of simply having to trust that it does what we claim it does.
It is visible in our commit history that we did our best to ensure that:
- refactoring/simplification commits did not change the logic of the code
- commits that did change the logic of the code were carefully considered by all of us and made the code more correct.
This commit likely fixed a vulnerability, as discussed in the code comment there.
Unfortunately it also introduced a vulnerability. It turned reserveDelta to what it should be, but a different part of the code was expecting it to be something else. That different part of the code was a condition that, due to this commit, become tautological (i.e. always true, and therefore unnecessary) and, consequently, was removed in [this commit] (https://github.com/pulsarz/hodlcoin-contracts/commit/a8fbc5bb14f966770ec197bb7279a92653fc21db).
The problem has been fixed in this commit.
A test to ensure that the vulnerability does not occur anymore was implemented here.
We are immensely thankful to Krasavice Blasen, who found this vulnerability and who decided to drain the ERGs from the contract and return them to the users, instead of exploiting the vulnerability for his own personal gain.
Before re-deploying the project, we will:
- write more "negative" tests (of transactions that ought to be rejected by the contract)
- review the code over and over again, once again.
- keep our code and its history available to the community for further inspection. The latest version, with the fix, is available here.
We invite the entire community to review the latest version of the contract as well and contribute with commits that improve the code and fix any other eventual potential vulnerability.
Where did HodlCoin come from?
Was some demand in the community for some degen finance. Kushti wrote up this concept
But then Bruno from Djed (Worked at IOG during the design - not COTI) shared an idea with him and he connected him with Pulsarzz to get it up and running.
Yes. It dates back to 2020, actually. :-). I was trying to simplify the design of Djed/SigmaUSD, to try to come up with a stablecoin protocol that would need no reservecoin and no oracle. ๐ And then I ended up with hodlCoin. But I dismissed it back then as something crazy (which it is, if your goal is to create a stablecoin, since hodlERG's price only increases :-D)... ๐ Then, in summer/autumn of 2022, I shared this idea with @kushti_ru and, in Spring of 2023, he convinced me that this would be an interesting DegenFi product. The collaboration with @pulsarzz started then and I am still amazed by how fast it all went from there. Ergo's capacity for innovation is incredible.
With great timing, the paper was been published in eprint this morning heh https://eprint.iacr.org/2023/1029