Alchemix Patches “Free Money” Bug as 2,000 ETH Returned Prematurely

DeFi exploits are notorious for leaving investors with bad debt that might take months or years to settle. But in a surprising first for a decentralized finance protocol, users benefitted from a bug in the system. Earlier today, DeFi loan platform Alchemix announced that it had experienced an “incident”, which allowed users to withdraw $ETH collateral with their aIETH loans still outstanding.

There has been an incident with the Alchemix alETH contracts. Together with the fantastic team at @iearnfinance, we have identified the error and are both working on a post-mortem and a solution to the problem.

Funds are safe.

— Alchemix (@AlchemixFi) June 16, 2021

Alchemix Bug Dubbed as “Reverse Rug Pull” by DeFi Observer

DeFi protocol Alchemix has patched an error that led to the incorrect calculation of outstanding debts. The bug seemingly forgave users’ existing loans prematurely and permitted them to claim the free money. Some sources cited that the company might have lost 2,000 $ETH in forgiven debts.

The snafu was dubbed by a DeFi observer as a “reverse rug pull”. For those not in the know, a rug pull situation occurs when founders or developers of a DeFi project deplete its liquidity owing to a system exploit. In such circumstances, depositors are left to struggle for months and sometimes years to receive compensation. However, in Alchemix’s case, the users were given the better end of the deal.

While elaborating on the incident, an Alchemix developer who goes by the pseudonym “n4n0” said that “an issue with the deployment script of the alETH vault accidentally created additional vaults,” some of which the protocol used to incorrectly calculate outstanding debts, which in turn meant protocol funds were used to “pay off user debts.”

alETH Investigated the Issue and Released a Post-Mortem

Alchemix facilitates borrowing by letting users procure loans in the project’s aIETH tokens in exchange for $ETH deposits for a fixed duration. According to the company’s discord server responses, the current issue allowed users to borrow aIETH and take their collateral prematurely, generating money for them out of thin air. 

Following the discovery of the exploit, Alchemix sprung into action and paused the minting of aIETH. The company also published a post-mortem of the exploit and reported that none of its users lost funds in the process, albeit some were able to withdraw funding which they should not have.

To address similar issues in the future, Alchemix has put three solutions in place, including a short-term hike in protocol fees, an injection of $ETH liquidity from its own treasury, and a sale of DAI tokens to obtain additional $ETH. The team will also design a new vault to address the errors that plagued the original.