Harmony to Chaos, Stables on Stables(?), Pirex by Redacted Cartel

Projects continue to innovate and adapt to the bear market, while Harmony is the latest victim of yet another major cross-chain exploit. We take a look at the latest developments in DeFi.

Will Harmony descend into chaos?

Harmony Horizon ETH Bridge TVL. Source: @no_available_data, Dune Analytics https://dune.com/no_available_data/Ethereum-bridges

Last week on June 23rd, an exploit of the Harmony Horizon Bridge totalling ~$97M occurred. Horizon has two bridges into its ecosystem, the Horizon bridge which bridges Harmony to ETH/BSC and its trustless Bitcoin bridge, whereby the latter remains unaffected. 

The Horizon Bridge, while initially planned in its roadmap to become decentralized, still currently operates with a multisig contract. According to Certik, the attacker somehow managed to control the owner of the MultiSigWallet to call a contract function directly to transfer large amounts of tokens from the Ethereum-side of the Horizon Bridge. 

Harmony’s founder reports that the exploit was likely due to private keys being compromised, as there was no evidence for a breach in the smart contract code. According to Polygon’s CSO and Rugdoc.io, the Horizon bridge operated with a 2 out of 5 multisig contract, which means that only two keys needed to be compromised in order to access the funds on the contract. However, since the exploit, custody has now shifted to a 4 out of 5 multisig contract.

The Harmony team has received backlash from the community who pointed out that warnings regarding the Horizon Bridge had been flagged months ago. The inherent risks of cross-chain bridges has been long discussed, and implementing a 2 out of 5 multisig contract to custody bridged funds is deemed by many to be gross negligence on the part of the Harmony team.

Harmony treasury as of 16th May; now totalling an estimate of a min >$40M if composition remains unchanged. Source: https://open.harmony.one/team-founding-story/may-2022-team-deliverables

Horizon’s exploit means that bridged assets on Harmony, which comprised most of the chain’s TVL, is now unbacked. If funds are not recovered, the situation is bleak for Harmony and its affected users. Harmony has offered a $1m bounty for a return of the funds and details of the exploit, but as of 27th June the exploiter has started using Tornado Cash to mix the stolen funds. As striking a deal with the exploiter and awarding them a white-hat title / bounty seems to have flown out the window, other reprieves could come in the form of bailouts (Sam, is that you?) or replenishing the bridge via their treasury and/or fundraising.

This is the third major cross-chain bridge exploit to occur this year, following the massive Poly Network (Aug 2021), Wormhole (Feb 2022), and Ronin exploits (Mar 2022) which total ~$1.5B in losses (if disregarding the return of Poly Network funds by Mr. White Hat). Tellingly, these exploits top the rekt leaderboards, and all involve cross-chain applications. The rise of many different blockchains over the last bull run spurred many to envision a multi-, cross-chain future for crypto. However, some, most notably Vitalik, disagree with this projection. He thinks that crypto will definitely be multi-chain, but that separate blockchain ecosystems should not be intricately linked due to the risk of contagion effects and inherent security risks associated with cross-chain bridges. 

Supporters of cross-chain applications believe that interoperability between chains facilitates the growth of the crypto space, but it is unclear if this growth will be offset by the progress hindered by the loss of public confidence following such exploits. Only time will tell which path we take - do we burn the bridges, or build stronger ones?

An aside: Perhaps as a silver lining, one interesting use-case highlighted in this hack was from Lossless, a hack-mitigation protocol. One of the projects which suffered from stolen tokens during this exploit was AAG Ventures. With implementation of Lossless’ code in their smart contract, AAG were able to recoup almost all of their stolen funds, worth ~$900k at the time. While solutions like Lossless have not been tested at scale, we expect to see more interesting safety nets and backstops to emerge, whether or not cross-chain bridges continue to be built.

Stablecoins on Stablecoins

Last week, the Decentral Bank DAO confirmed that there will be a (temporary) pivot in USN’s mechanism. While initially overcollateralized with NEAR and USDT, it will now transition to being backed 1:1 with only USDT. The change is due to the risk of under-collateralization of USN should the price of NEAR continue to fall - which is not an unlikely possibility during this bear market. It is asserted that USN will be a stablecoin which is able to adapt to market conditions, and that once a more bullish environment returns, NEAR and other collateral can be reintroduced for the minting of USN.

Essentially, now USN will act as a wrapped USDT token which earns a yield (currently 8-12%) from the staking rewards generated from Decentral Bank’s NEAR reserves (which were collected from the initial minting of USN from NEAR). USN could also be thought of as a method to capitalize on NEAR staking rewards without gaining exposure to the volatility of the NEAR token itself.

According to Res of Proximity Labs during a Twitter space chat, the yield generated from USN will be a function of NEAR’s price and the USN circulating supply. Whether yield is eventually paid in USN (or possibly NEAR), a downside of this strategy is that this introduces a constant selling pressure to NEAR for as long as this mechanism is implemented. Additionally, it is unclear how / how long yield on USN will be maintained if the market cap of USN increases further and staking rewards from NEAR reserves are distributed to more USN holders. Naturally however, an equilibrium should be reached where demand for USN will decrease as its yield decreases, which then results in increased yield which encourages holding.

Further details will likely be fleshed out this week, as Decentral Bank rolls out updated documentation for USN.

Pirex by Redacted Cartel

Redacted Cartel was originally created as a complementary subDAO for the infamous Olympus DAO (OHM) to influence governance throughout DeFi. Its primary focus has been in the Curve ecosystem, and initially accumulated assets such as Curve (CRV) and Convex (CVX) via its bonding mechanism. In return for providing aforementioned tokens, investors received discounted Redacted (BTRFLY) tokens. 

It was one of the largest players in the “Curve Wars,” rising to become the second largest holder of CVX fairly quickly, but has since been overtaken. However, it has since moved away from its Olympus bonding mechanism, and has introduced a new product in the form of Pirex. 

Alternative method to obtaining CVX

Currently, CVX holders have to lock their tokens in exchange for vote-locked CVX (vlCVX). The lockup period ranges between 16 to 17 weeks, and during that time, vlCVX can be delegated on Votium to receive bribes as part of the Curve Wars. 

While that process is straightforward on paper, it can get complicated when the likes of rewards, and liquidity are taken into account. With so many protocols taking part in the Curve Wars, rewards are given out in various governance tokens as well, which complicates the process of claiming and selling these tokens. For example, rewards could be given out in CRV and CVX. The user will then have to claim these rewards, and then sell them to whichever currency they prefer. This adds unnecessary steps to the whole process, complicating things. Also, vlCVX is illiquid, meaning it can’t be moved / traded during the lockup period. In that case, investors lose out on other opportunities if they arise. On top of that, users aren’t able to monetize any potential future earnings.

Redacted Cartel aims to solve these issues with the introduction of Pirex. The new protocol contains a number of offerings in order to cater to a broader market. There are set to be three modes to choose from: Easy Mode, Standard Mode, and Expert Mode. Currently, only Easy Mode is available to users. The underlying part of its new product is the pxCVX (pirex CVX) token which is a vlCVX liquid wrapper. 

Easy Mode is an automatic compounder built in collaboration with Llama Airforce. Users simply need to deposit their CVX into Pirex for pxCVX. This is then compounded every pxCVX epoch (every two weeks) by converting the rewards into more pxCVX without the need for manual intervention. Swapping between CVX and pxCVX can be done on Curve itself, as the team at Redacted has seeded and is maintaining such a pool.

Standard Mode allows investors to deposit their CVX for pxCVX as well. Pirex then takes this CVX to be locked for vlCVX continuously. Every epoch (two weeks), holders will be able to claim any bribe revenue that is generated, or let the revenue accumulate over time, instead of making a claim bi-weekly. This differs from Easy Mode as rewards are not autocompounded, giving users more flexibility to how they want to manage their future rewards… 

Which brings us to Expert Mode, which will allow CVX users to speculate on their future yield by giving them the ability to tokenize future pxCVX yield. Once this feature is live, any pxCVX holders will be able to stake their pxCVX, select the number of rounds of gauge votes to tokenize, and receive spxCVX and Future Notes in return. spxCVX are essentially pxCVX which do not accrue rewards any longer. Future Notes can be further broken down into Reward Futures Note (RFN) which gives users a claim on future bribe revenue, or Vote Futures Note (VFN) which can be used on future gauge votes. RFNs and VFNs can be exchanged 1:1 for one another, and will be tradeable on the Pirex marketplace (the marketplace is still under development at the time of writing) as well. Therefore, if a profit maximalist user wanted to make use of the Expert Mode, they would obtain RFNs with their pxCVX, and sell it on the marketplace to lock-in future bribe rewards. Meanwhile, someone who wants more gauge votes may purchase those RFNs on the marketplace and simply convert them to VFNs and vote on the gauge of their choice. 

For example, Ben stakes 10 pxCVX for 10 weeks, which is equivalent to 5 Pirex reward epochs. Being a profit maxi, Ben tokenises the future vote events as RFNs and receives 10 spxCVX. This can be unstaked for the initial 10 pxCVX but only after the 10 weeks have passed. 10 RFNs are given to Ben as well, which can then be sold on the Pirex marketplace. The buyer of Ben’s RFNs can then (1) convert it to bribe revenue in the future or (2) convert the RFNs to VFNs to vote on the gauge of its choice in the future.

Our Thoughts

Through Pirex, Redacted Cartel is still able to obtain CVX by incentivizing individuals to delegate their CVX to them via pxCVX, mainly by giving them convenience in terms of auto-compounding rewards, the possibility of tokenizing future rewards, as well as liquidity for the otherwise illiquid vlCVX. This solves the earlier issue of issuing BTRFLY in return for CVX and CRV, which resulted in selling pressure and dilution of the governance token. However, this comes at the expense of building a pool of protocol-owned liquidity, as the pxCVX tokens are now simply staked in the protocol, similar to staking with a validator on a chain in exchange for rewards, instead of being fully owned by the protocol like BTRFLY.

The financial modelling required to trade RFNs and VFNs are complicated, and it remains to be seen if Pirex can find a sufficiently large audience and interest to maintain an efficient market. Normal users may well just opt for Easy Mode just to enjoy the auto-compounding feature and additional yield for their CVX without sacrificing liquidity.

While novel, the use case for Pirex is still limited given its current features and sole support of CVX. There is still a long way to go for the project, and it remains to be seen if pxCVX would become a widely-accepted asset pair in other DeFi Protocols. However, with the addition of more assets planned further down the road, it may open a gateway for added utility to “valueless” governance tokens out there.

Note: We will be taking a break for the next two weeks (Weeks of July 4th and 11th) to prepare the Q2 quarterly report. Normal market update will resume on the week of June 18th.

This article was written in collaboration with Wendy. You can follow her on Twitter at @alfalfawm