Curve.Fi USD Stablecoin price

3D Rights Protection Record | 002 Today, I mainly want to chat with everyone about these three questions: 1⃣ What is the relationship between Resupply and Curve? 2⃣ Why are we so angry 😡? 3⃣ How is it that the Resupply team gets stolen from an average of 10 million every year?

It's been more than three days, and the only thing I'm curious about is why @ResupplyFi isn't doing any work related to attack tracing/white hat bounties? The hacker hasn't continued to transfer nearly $9.6 million in ETH assets from the two related addresses... It's still undecided whether they are a black hat or a white hat... But if there's no tracing, the hacker will likely go down a dark path and become a black hat... I'm not speculating on possibilities, just purely curious.

as one of the top three investors in the resupply project, with millions of dollars at stake, this incident has caused not only significant financial loss, but also intense psychological pressure. yet simply for raising reasonable concerns in the official discord, i was muted without cause. that kind of response is unacceptable. at this point, debating the definition or mechanics of the insurance pool is meaningless. i want to make my position clear: 1/ many investors, myself included, only dared to commit this level of capital because resupply was presented as having the credibility of curve behind it. let’s be honest. if teams like curve, convex, and yearn had not publicly or privately signaled involvement, few would have touched a new protocol like this with size. now, those same parties are distancing themselves, which is infuriating. 2/ this loss was not caused by market volatility or a bad debt event. it was a critical technical failure — an erc4626 inflation bug that happened because the team failed to burn initial shares when deploying a new vault. this allowed an attacker to mint unlimited shares at almost no cost and drain the assets. this is a protocol-level issue and a severe oversight. 3/ in any security incident, the first step should be to investigate the exploit and protect user funds. instead, the resupply team’s first reaction was to push losses onto insurance pool depositors, while silencing and mocking those who disagreed. i have been in defi for years. i have never seen a team act with such a lack of accountability. 4/ the insurance pool was never meant to cover technical failures by the development team. if protocol creators start treating user funds as a backstop for their own mistakes, they are effectively saying that depositors exist to take the hit. insurance is meant to cover black swan events and market risk, not internal negligence. 5/ there is no defi precedent where an insurance pool covers damage from a bug caused by the protocol team. if resupply intended that, it should have been clearly stated in the docs. it was not. instead, the team continues to twist the narrative in discord while muting anyone who pushes back. 6/ curve and crvusd benefited materially from resupply. they should not be allowed to walk away from this. the exploit was not a market issue. it was a critical design and deployment flaw. responsibility lies with the team, not the users. 7/ c2 stepping up personally to cover around 1.5 million dollars shows character. but that cost should not fall on one individual. it should come from convex or yearn’s treasury if they still stand by the project they helped launch. 8/ i respect what michael has done for curve, and i appreciate his effort to mediate throughout this situation. but that does not mean i will back down. 9/ what i and every resupply investor need now is a fair resolution. return the user funds that were lost due to your own mistake. do the right thing.

Seeing the onekey boss protecting his rights with Resupply, losing several million in assets, I can't help but sigh that DeFi is really too fragile. After looking around, it seems that no one has explained clearly how the hacker attacked, so I did some research myself and want to share it with everyone: The main character of the story is ResupplyPair, where users can borrow by staking assets. The isSolvent modifier in the contract is responsible for checking whether the user is eligible to borrow the requested assets, and the specific code logic is as follows: You can see the calculation of ltv on line 282. If we can set _exchangeRate to 0, then the check will always pass, right? Continuing to read the code: You can see that this variable comes from the oracle's getPrices call, and it is in the denominator. In other words, we need to make the price of collateral extremely high. By reading the oracle's code, we can see that getPrices is just a layer of forwarding, and it actually calls the convertToAssets interface of the staked asset (i.e., the vault). Continuing to read the code: You can see that this result consists of very complex mathematical operations. Here, the hacker amplified the numerator, further affecting total_assets, completing the attack. By checking the implementation of the _total_assets function, we can find that: This value is related to the borrowed_token held by the controller contract of this vault, which is crvUSD. At this point in the analysis, it becomes clear that ResupplyPair was created using an empty vault. The hacker transferred a certain amount of borrowed_token to the controller contract of the vault, ultimately causing _exchangeRate to drop to zero, thereby infinitely amplifying the value of their staked assets and borrowing up to 10 million reUSD at a very low cost. Attack transaction: ResupplyPair contract address: Vault controller contract address: Vault contract address: Oracle contract address:

as one of the top three investors in the resupply project, with millions of dollars at stake, this incident has caused not only significant financial loss, but also intense psychological pressure. yet simply for raising reasonable concerns in the official discord, i was muted without cause. that kind of response is unacceptable. at this point, debating the definition or mechanics of the insurance pool is meaningless. i want to make my position clear: 1/ many investors, myself included, only dared to commit this level of capital because resupply was presented as having the credibility of curve behind it. let’s be honest. if teams like curve, convex, and yearn had not publicly or privately signaled involvement, few would have touched a new protocol like this with size. now, those same parties are distancing themselves, which is infuriating. 2/ this loss was not caused by market volatility or a bad debt event. it was a critical technical failure — an erc4626 inflation bug that happened because the team failed to burn initial shares when deploying a new vault. this allowed an attacker to mint unlimited shares at almost no cost and drain the assets. this is a protocol-level issue and a severe oversight. 3/ in any security incident, the first step should be to investigate the exploit and protect user funds. instead, the resupply team’s first reaction was to push losses onto insurance pool depositors, while silencing and mocking those who disagreed. i have been in defi for years. i have never seen a team act with such a lack of accountability. 4/ the insurance pool was never meant to cover technical failures by the development team. if protocol creators start treating user funds as a backstop for their own mistakes, they are effectively saying that depositors exist to take the hit. insurance is meant to cover black swan events and market risk, not internal negligence. 5/ there is no defi precedent where an insurance pool covers damage from a bug caused by the protocol team. if resupply intended that, it should have been clearly stated in the docs. it was not. instead, the team continues to twist the narrative in discord while muting anyone who pushes back. 6/ curve and crvusd benefited materially from resupply. they should not be allowed to walk away from this. the exploit was not a market issue. it was a critical design and deployment flaw. responsibility lies with the team, not the users. 7/ c2 stepping up personally to cover around 1.5 million dollars shows character. but that cost should not fall on one individual. it should come from convex or yearn’s treasury if they still stand by the project they helped launch. 8/ i respect what michael has done for curve, and i appreciate his effort to mediate throughout this situation. but that does not mean i will back down. 9/ what i and every resupply investor need now is a fair resolution. return the user funds that were lost due to your own mistake. do the right thing.