A full review of the Acala theft incident: how much was lost? How to solve? Can you copy the bottom?

On August 14, the Polkadot ecological project Acala was suddenly attacked by hackers. Affected by the parameter configuration error of the iBTC/aUSD liquidity pool, more than 1.3 billion aUSD were mistakenly dug out, causing the price of aUSD to be seriously unanchored, and the price on the chain fell below 0.01 Dollar.

In order to facilitate everyone to understand the ins and outs of this hacking incident, Odaily Planet Daily will conduct a comprehensive review of this matter in combination with Acala’s official disclosure and some market analysis.

1. What was the cause of the incident?

The root cause is that the parameters of the iBTC/aUSD liquidity pool are misconfigured. Specifically, the reward multiplier of the pool was mistakenly set to 500000000000000000, causing users to mine too much aUSD (more than 1.3 billion pieces) by mistake.

2. What is the current situation?

Affected by the erroneous issuance of 1.3 billion tokens, the price of aUSD has seriously destabilized. The unanchoring situation on the chain has not been alleviated for the time being, but due to the expectation that the problem can be properly resolved, the price in some off-chain CEXs (such as Kucoin) is gradually recovering the anchor.

3. How to calculate the real loss?

A considerable portion of what follows will draw on the analysis of Mangata Finance community contributor @Alice und Bob.

Although the market's attention is basically focused on the super addresses that minted 1.28 billion aUSD, given that Acala has "frozen" related fund transfers on the Acala chain including the 1.28 billion aUSD through an emergency vote, the actual loss is actually more From some other funds that have "fleeed".

4. How much money "fleeed"?

Before calculating the amount of "fleeing" funds, let's take a look at the four main ways for funds to "flee":

a. Send aUSD to Moonbeam ;

b. Convert aUSD to DOT and transfer to Polkadot;

c. Convert aUSD to iBTC, and then transfer to Interlay;

d. Transfer directly to CEX to cash out.

Combined with the statistics on the chain made by Alice and Bob, a total of about 4.6 million aUSD was transferred to Moonbeam; a total of about 1.6 million worth of DOT and iBTC were sent to Polkadot and Interlay. The corresponding main profit addresses of the two methods are 23bmUgSeKMD8Y9triphPw5YHuiz3QUJNqcbmb3Eg9QMQDMWN (165,000 DOTs) and 253pFTg22JqHbLeLZupexGMDUuXAJLfEriTYkFqvGWPuwcFi (3.4 iBTCs); the amount of funds transferred directly to CEX is temporarily unknown.

In summary, Alice und Bob roughly estimates that the real capital loss is less than 10 million US dollars, and the clearest value asset outflow (mainly counting DOT and iBTC, because it also has a stable value in the external environment) is about 1.6 million US dollars.

5. Can the outflow funds be recovered?

Currently, Acala is appealing to white hat hackers to return the outflow funds, and has announced the funds recovery addresses on other chains such as Polkado and Moonbeam.

The data on the chain shows that most of the funds "fleeing" to Polkadot (a total of 123,000 DOTs) are still in the two addresses of 13jPj2erXSznxvS9CmbjwRGUxF3vQFUcc4BSMAmujwTBgajB and 138v8GKge6sEAkBqRymUAFJtfMMEfLmk5ZruKwao2AKXEhpi It is expected that Acala may jointly take some governance measures with Polkadot to execute recycling.

6. What is the key to solving the problem?

On the whole, there are actually two problems facing Acala:

One is how to deal with the frozen funds on the Acala chain (aUSD and other exchanged tokens). Considering that this part of funds is in a controllable state, it is not too difficult to solve this problem, but it requires the community to make a collective decision (high probability It is the path of destruction).

The second is how to recover (or fill in) and deal with the "fleeing" funds. Among them, the situation of DOT and iBTC with relatively stable prices is relatively simple. The more complicated issue is how to deal with the funds that have flowed out (such as Moonbeam) and have been traded. aUSD —— If the aUSD issued by mistake on the Acala chain needs to be destroyed, what should be done with this part of aUSD? If it is regarded as 0 value together with other aUSD that needs to be destroyed, how should the incurred transaction loss be calculated?

Only by properly solving the problems at these two levels can aUSD return to the normal mortgage state and get effective anchoring support.

7. Can I buy the bottom of aUSD?

Yesterday, as the price of aUSD fluctuated greatly on CEX, many users began to consider the "risky move" - buying aUSD at the bottom.

Since the swap function on the current chain has been suspended, there are only a few CEXs (such as Kucoin) and DEXs on other chains (such as StellaSwap on Moonbeam) that can actually perform bottom-hunting operations.

To put it simply, whether you can buy the bottom depends entirely on your expectation of whether Acala can solve the incident . If you believe that Acala can properly handle all problems, then it is only a matter of time before the recovery of aUSD anchoring, and vice versa. That's another ending.

Perhaps out of trust in Acala's past word-of-mouth, judging from the current trend of aUSD's gradual re-peg, the market seems to have a relatively positive attitude towards the outcome of the incident.