Fluid has produced a post-mortem of the Resolv hack, confirming that all $19.3 million in bad debt has been repaid and stating that all user funds are secure. The unfortunate exploit of March 22 occurred due to an attacker finding their way into the Resolv infrastructure through compromised signing; this incident resulted in the minting of around 80 million uncollateralized USR tokens.
How the Fluid repayment worked
Fluid had approximately $100 million in risk exposure to Resolv, and this resulted in approximately $21 million of bad debt. After the incident occurred, some opportunistic actors used Resolv wstUSR (WSTUSR), a wrapped stake token, posted it as collateral at the inflated oracle price, borrowed stablecoins, and abandoned the positions, which resulted in bad debt remaining on the protocol.
The Fluid repayment framework differentiates between pre-incident and post-incident exposures:
- Pre-incident positions with positive equity are expected to be made whole by Resolv.
- All bad debt that was created after the incident will be split fairly between Resolv and Fluid.
Based on what was agreed upon, Resolv covers 50 percent of losses for decentralized exchange (DEX) liquidity providers (LPs) who had pre-incident exposure. The remaining $8.2 million in bad debt and unused wstUSR will be paid/returned to users by the Fluid team out of future protocol revenues. Subsequently, all remaining USR tokens within the Fluid protocol have been burned at the contract level by Resolv, and all users currently holding healthy positions will be able to redeem them directly through Resolv.
Key findings of the Resolv hack review
The Resolv hack review substantiates that Fluid’s smart contracts have not been breached, that no Fluid code has been compromised, and all other markets on the protocol were operating as expected at the time of the incident. Within hours of the incident, Fluid paused affected markets and secured external commitments from @Lomashuk (cyber.fund), @weremeow, and the Fluid core team to backstop any remaining debt, which eliminated risk to any user funds.
Looking ahead
Fluid will continue to work on rebuilding its treasury before resuming discretionary spending. The major changes to the treasury include:
- Pausing buybacks (1.3 percent of the FLUID supply has been repurchased so far)
- Reduction or elimination of FLUID emissions
- The Foundation’s planned $250K/month allocation for March through June will be suspended
The treasury impact notwithstanding, Fluid continues to make progress on several major initiatives, including institutional partnerships with some of the largest asset managers, banks, as well as regulated entities. Additionally, the protocol will upgrade its oracle and pricing systems through multi-source feeds, deviation checks, and granularity of pause controls to better accommodate extreme scenarios.
This is another “happy” DeFi story that has been resolved somehow. Recent brutal Drift and KelpDAO exploits are also executing asset recovery plans after massive losses that left the industry bleeding.