YFV Staking Pool v1 Post-Rescue Update
On Aug 31, 2020 01:50:00PM GMT+0, the YFValue team executed the rescue plan with the cooperation and coordination of all farmers who were still locked inside YFV Staking Pool v1. The rescue event occurred suddenly and within an extremely short time frame by design such that the malicious actor would not have time to prepare nor meaningfully interfere efficiently with the rescue process.
Process Details
We approached the cosigners and explained the situation and our proposed strategy to them. To mitigate the risks of potential leaks, we wanted to execute the plan very quickly. All approached cosigners agreed to sign the addMinter(vUSD) tx, enabling the pool to run another epoch and giving people time to withdraw their funds.
As a result, we are pleased to announce that 192 YFV holders exited successfully. 66 YFV holders are currently able to exit, but still have not left the pool. Finally, 274 YFV holders suffered another timer reset attack, meaning that their funds are still frozen.
We were able to rescue about 127k YFV that were staked in the pool from the attacks.
Unfortunately, certain coordination problems hindered the plan’s effectiveness. Some YFV holders may have misunderstood the provided instructions and attempted to exit before the execution time (and failed), thus alerting the hacker. These events gave him enough time to prepare and re-apply the timer reset attack again. As a result, about 139k YFV are currently still locked in stake pool v1.
Moving forward:
As a consequence of the rescue plan, the stake pool v1 will continue to emit an additional 63k YFV until the next epoch. While it is likely that the stakers who are in the pool will continue to experience timer reset attacks, the silver lining is that they will still be able to take out YFV rewards anytime. Concurrently, the attacker will continue to spend about 10 ETH every 3 days in gas fees to continue his malicious campaign. We at YFV are happy that he has chosen to support the community of ETH miners :).
We have heard the community’s feedback, and we propose the following two options:
1.Keep the v1 staking pool as it is now, burning it at the next epoch in 6 days (burning it now is technically impossible).
Current YFV stakers in the pool will continue to receive rewards (63k YFV in total) in the form of compensation. The remaining YFV will be fully reimbursed by the dev team (about 76k YFV). Of course, for technical reasons the complete reimbursement will take place around 21 days from now on, as the dev fund vests over 50 weeks (in the spirit of our community focus, we chose not to do a significant pre-mine).
2. Another possibility is to leave the v1 staking pool running for an additional epoch until 14-Sep to generate an additional 63k YFV as a bonus for stakers who are stuck in the pool. This option lightens the burden on the dev team by reducing our reimbursement from 76k YFV from option 1 to 13k YFV.
Note:
- Option 1 WILL NOT generate more YFV. The effective YFV in circulation is actually reduced by 76k (139k YFV being stuck forever in the pool 0–63k generated by the pool)
- Option 2 ALSO WILL NOT generate more YFV. The effective YFV in circulation is actually reduced by 13k (139k YFV being stuck forever in the pool 0–126k generated by the pool)
Warning:
Advanced users will have the option of interacting with the smart contract to deposit YFV into the staking pool. If you do this, we WILL NOT compensate you for any locked funds in the case they are subject to the timing attack by the hacker. You do this entirely at your own risk and at the detriment of those whose funds are lost in the YFV staking pool and to the broader YFV community.
Procedure:
We will put this proposal up for voting on our newly implemented off-chain voting system, which will go live this Friday, 4-September. All stakers who are stuck in the seed pool v1 will be able to vote.
