Examiner Appointed to Celsius Bankruptcy Case, Crypto Lender Files for Access to $23M in Stablecoins

September 17, 2022 Bitcoin.com

Avalanche flash loan exploit sees $371K in USDC stolen

September 8, 2022 Coin Telegraph

Avalanche

The scammer deployed a custom smart contract, leveraging a $51 million flash loan to manipulate the AVAX/USDC Trader Joe LP pool price for a single block.

Avalanche-based lending protocol Nereus Finance has been the victim of a crafty hack that saw a user net $371,000 worth of USD Coin (USDC) using a smart contract exploit.

Blockchain cybersecurity firm CertiK was one of the first to detect the exploit on Sept. 6, indicating that the attack impacted liquidity pools on Nereus relating to decentralized exchange Trader Joe and automated market maker Curve Finance.

CertiK also suggested that underlying protocols themselves were impacted, however, Curve Finance responded via Twitter on Sept. 7, stating “maybe you meant ‘assets impacted,’ not ‘protocols impacted’. Only @nereusfinance and its assets seem impacted.”

On Sept. 7, Nereus Finance released a detailed post-mortem of the incident explaining an “exploiter” was able to deploy a custom smart contract that utilized a $51 million flash loan from Aave to artificially manipulate the AVAX/USDC Trader Joe LP (JLP) pool price for a single block.

We've published a post-mortem on the NXUSD incident from yesterday. https://t.co/ADhu6PagP2
Thanks @peckshield @CertiK
— Nereus Finance (@nereusfinance) September 7, 2022

As a result, the anonymous hacker was able to mint 998,000 worth of Nereus' native token NXUSD against $508,000 worth of collateral. They then swapped this capital into different assets via various liquidity pools and managed to walk away with a net profit of $371,406 once the flash loan was returned.

The incident ended with to the creation of $500,000 of NXUSD “bad debt” in the NXUSD protocol.

The Nereus team says it was quick to remedy the situation; after consulting security experts, developing a mitigation plan, and notifying law enforcement, they liquidated and paused the exploited JLP market.

The bad debt was reportedly paid off using NXUSD from the team’s treasury.

According to Nereus, the exploit resulted from a “missed step” in the price calculation, resulting in the opportunity to be exploited. However, it stressed that “no users funds are at risk, and NXUSD continues to be over collateralized” and the “Lending and Borrowing protocol was not affected by this exploit.”

Nereus is also confident the same exploit won’t be possible a second time, as the team will be amending its "audit and security practices in order to ensure these types of events do not occur in the future," noting:

“While this exploit is a bad incident — it’s not uncommon for protocols to face these types of battle tests.”

As of this writing, the Nereus team is trying to identify the hacker and track the funds and has offered a 20% White Hat reward for the return of the funds, no questions asked.

Despite this recent flash loan exploit and several other notable incidents throughout the year, CertiK's August 2022 Monthly Skynet Alerts Report, released on Sept. 2, claims there has been a notable decrease in these types of attacks.

Compared to the previous month, August saw a drop of 95% in flash loan attacks, only resulting in a total loss of $745,244, the second lowest this year.

February still has the lowest recorded loss from flash loan exploits with only $200,000.

Circle co-founder says converged dollar books on Binance would be good for USDC

September 6, 2022 Coin Telegraph

Binance

The world's largest crypto exchange announced yesterday it would cease trading support for USDC and auto-covert deposits to its own stablecoin after Sept 29.

According to a new Twitter post, Jeremy Allaire, co-founder and CEO of USD Coin (USDC) stablecoin issuer Circle, said that the recent decision by Binance to merge stablecoin dollar books is "a good thing" for USDC. "This move would lead to a gradual net share shift from USDT to BUSD and USDC," said Allaire.

The day before, Binance announced it would cease trading support for USDC and auto-convert deposits after Sept. 29 to a consolidated Binance USD balance comprising other stablecoins pegged to the U.S. dollar. Users will be able to withdraw individual constituents from the consolidated balance at par value.

Some users pointed out that it's now possible to deposit and withdraw USDC seamlessly in Binance. Before the change, it was required to first convert USDC to BUSD or USDT and then use it to trade leveraged products. Therefore, the overall liquidity of USDC would increase.

However, others pointed out that the automatic conversion could potentially result in greater redemption of USDC to mint more BUSD. According to Nansen, USDC held by Binance has decreased to less than 1 billion from 2.5 billion in July. Meanwhile, the exchange holds around 5 billion USDT.

Data from Dune Analytics suggest that USDC is currently the second-most popular stablecoin in the world, accounting for 33.5% of transactions in the category. It has been gaining in market share since two years prior. Tether is currently the most widely-used stablecoin, with a market share of 50.3%. Meanwhile, Binance USD sits in third place with 15.1%.

Binance: No plans to auto-convert Tether, though that ‘may change’

September 6, 2022 Coin Telegraph

Binance

The crypto exchange was responding to questions from Cointelegraph after announcing it would cease trading support for USDC and two other stablecoins this month.

Crypto exchange giant Binance has confirmed it has no plans to “auto-convert” Tether (USDT) to Binance USD (BUSD) at the moment, though noted that this “may change.”

On Sept. 6, the crypto exchange surprised the market with the announcement it will cease trading support for U.S. dollar-pegged stablecoin USD Coin (USDC) on its platform, along with USDP Stablecoin (USDP) and TrueUSD (TUSD).

Any users that are still holding the three stablecoins on Sept. 29 will begin to have their holdings auto-converted to BUSD at a 1:1 ratio over a 24-hour period.

Binance stated that the move was a decision to enhance liquidity and capital efficiency for users, but notably did not make any mention of the largest stablecoin by market cap, Tether USDT.

In a statement to Cointelegraph, a Binance spokesperson confirmed there were no immediate plans to do the same to USDT, but noted that this could change, stating:

“We do not have plans to auto-convert USDT to BUSD as of now, but may change.”

The spokesperson also confirmed that the auto-conversion and move to cease most trading services for USDC is “not a temporary measure,” and that it “will continue.”

Binance CEO Changpeng Zhao (CZ) in a Sept. 6 tweet clarified that the company won’t be de-listing the three stablecoins, but is “just merging all liquidity into one pair,” adding that it will offer the “best price, lowest slippage for users.”

Binance will also remove the long list of spot trading asset pairs matched to these stablecoins, with the pairings switching primarily over to BUSD.

Users will also need to keep an eye out for the use of USDC in the exchange’s staking, savings, liquid swaps, and loans, as those services will be shut down for that asset also.

The move from Binance comes alongside a temporary suspension of Ether (ETH) and Wrapped ETH (wETH) deposits and withdrawals on selected networks from Sept. 6 until the Ethereum Merge goes through later this month.

Data from Nansen shows that Binance has been gradually converting USDC to BUSD since mid August, with roughly $1.5 billion worth switching over during that time according to the analytics platform’s CEO Alex Svanevik.

Binance has less than $1B USDC now. pic.twitter.com/Sx4Wjr43V5
— Alex Svanevik (@ASvanevik) September 6, 2022

As it stands, Binance now has less than $1 billion worth of USDC on the platform, with around $993.3 million at the time of writing. In comparison, Binance holds a whopping $4.99 billion worth of USDT, more than any other exchange across the globe.

New Study Says Number of Cryptocurrencies Now at 10,000 — Five Coins Account for 75% of Total Market Cap

August 31, 2022 Bitcoin.com

DEX accidentally hits ‘kill-switch’ on mainnet, locking 660,000 USDC inside

August 30, 2022 Coin Telegraph

Coin Telegraph

The deployment of a program upgrade went terribly wrong as a fateful “Solana program close” command stopped OptiFi's platform indefinitely.

A decentralized cryptocurrency (DEX) options exchange cut its own life short after unwittingly executing a command that closed its mainnet program and made it irrecoverable.

OptiFi informed users that its platform had come to an unceremonious end after its development team tried to update its code on Aug. 29. According to the portfolio margining derivative DEX, the program incident also locked up some 660,000 USD Coin (USDC) on-chain.

OptiFi's program has been closed by mistakes we made.

TL;DR

1. We accidentally closed the OptiFi mainnet program and it's not recoverable
2. 661k USDC is locked in the PDAs, luckily 95% of the fund is from our team member
3. We will compensate for all users’ funds
— OptiFi (@OptifiLabs) August 29, 2022

OptiFi has pledged to compensate user funds lost by the error, while a large bulk of the locked-up USDC was reportedly vested by one of its team members. The company has also urged other developers working on the Solana blockchain to be wary of the ramifications of the ‘Solana program close’ command.

The platform unpacked the series of events that led to the sudden closure of its mainnet in a Medium post, which began with an attempt to deploy an update to its Solana program code on the mainnet.

Due to what the team described as bad network status, the deployment took longer than usual, and the command was canceled. However, a buffer address was created that received Solana (SOL) tokens that the team wanted to recover.

In the past, the team had managed to recover SOL tokens from buffer accounts without using memory phrases by closing the program. The approach initially looked to have worked after executing the command as the team recovered the SOL, allowing an attempt to deploy the program a second time.

An error message was returned indicating that the program had been closed and could not be re-deployed unless a new program id was used. Discussions with a Solana core developer confirmed the team's fears that it would not be able to redeploy the program with its previous id.

“Here it turned out that we didn’t really understand the impact and risk of this closing program command line. ‘solana program close’ is actually for closing the program permanently and sending the SOL tokens in the buffer account used by the program back to the recipient wallet.”

The OptiFi team has called for the Solana development community to explore two-step confirmation when running the ‘Solana program close’ function and caution users of the results of using the command.

USDC