Last week saw an attack on BSC-stablecoin $HAY, and its underlying Helio protocol (a Maker protocol fork). The exploit was preceded by an attack on staking protocol Ankr that saw the minting of 60 trillion aBNBc which is a reward-bearing receipt token for $BNB staked via Ankr’s platform on BSC. The freshly minted $aBNBc got dumped on PancakeSwap depegging the price from the underlying $BNB tokens.
Other attackers joined the exploit by buying large quantities of depegged $aBNBc on PancakeSwap and depositing them into Helio Protocol as collateral to borrow $HAY stablecoin. Helio’s oracle did not update the rate, allowing the attackers to deposit overvalued collateral tokens.
$HAY was ultimately sold off and led to a USD depeg. Helio incurred bad debt of $15m which Ankr will reimburse.
Helio could have prevented the attack by using the $aBNBc DEX prices for $aBNBc collateral but instead decided to reference $BNB prices for $aBNBc collateral. The infinite minting bug on Ankr was outside the control of Helio, but the oracle issue could have been prevented.
Gearbox’ oracles reference DEX prices of liquid staking derivatives directly, hence the attack vector from the Helio exploit cannot be reproduced.
There was relatively little FUD wrt stablecoins this week.
GUSD liquidity continued to drop (down to $8.7m). sUSD backing increased to 486% and LUSD backing hovers around 235%.
FRAX saw a slight liquidity increase to $400m. The other stablecoins remained largely unchanged.
Total pool collateral continues to increase from $18.4 to $19.5m. stkcvxcrvPlain3andSUSD was the biggest winner with +$4.5m, followed by yvDAI with +$0.4m and DAI (+$0.3m). stkcvxgusd3CRV experienced the biggest decline of -$2.2m, followed by stkcvxFRAX3CRV-f (-$2m)
The pool remains predominantly collateralized by stablecoins.
Total pool collateral remains largely unchanged at $29.4m. However, there has been some material changes within the collateral composition, most notably: stkcvxcrvPlain3andSUSD (+$3m), stkcvxcrvFRAX (+$1.1m), yvDAI (+$1.1m), stkcvxLUSD3CRV-f (+$0.5m), stkcvxFRAX3CRV-f (-$4m), stkcvxgusd3CRV (-$1.4m).
This pool also remains large backed by stablecoin assets.
The pool saw a material decrease of collateral value from $25.6m to $22.3m, driven by yvWETH (-$3.5m).
The pool remains collateralized by mostly ETH or staked ETH assets.
No change compared to the previous week
Total pool assets and borrow volume dropped to $1.08m and $0.9m, respectively. The pool saw outflows of $0.8m yvCRV-stETH. stkcvxsteCRV is now the main asset accounting for 96.6% of total pool assets.
Current risk parameters are on par with our models.
We continue to closely monitor stablecoin liquidity.
Additional stats, updated daily, are available in our dashboard at https://gearbox.riskdao.org/