Decentralized finance (DeFi) protocol Alchemix has resolved a bug that seemingly forgave borrowers’ loans prematurely, essentially giving them free money.
One DeFi observer on Twitter called it a “reverse rug pull,” referring to the crypto slang for when project founders abscond with user funds.
For an unknown amount of time, Alchemix borrowers could deposit ETH, get the project's alETH token in return and then withdraw the ETH used to secure their loans without having to pay them back.
"I was successfully able to borrow alETH, and take my collateral," user ptp1600 said in the Alchemix Discord server.
The issue seemingly affected the alETH pool, which was launched yesterday.
The Alchemix team said it’s investigating the issue and will publish a postmortem shortly. In the meantime, “the alETH contract has been paused and will remain so until our solution is implemented,” the project tweeted.
Alchemix co-founder Scoopy Trooples did not return a request for comment when initially contacted.
Alchemix published a postmortem of the snafu at 3:29 p.m. ET. No user funds were lost, rather users were able to withdraw ETH they should not have.
The bug started around midnight UTC, when users discovered they had “no outstanding debt even though they previously borrowed alETH at a 4:1 collateral ratio,” project admin n4n0 wrote.
It took about 15 minutes for Alchemix to halt the minting of alETH once the team started looking into the issue, n4n0 said.
The root cause: “the alETH vault accidentally created additional vaults,” the incident report notes.
The post concludes with an ask:
Alchemix’s native token, ALCX, is down 21.5% since the bug was first noticed, according to CoinGecko.
Brady Dale contributed reporting.
UPDATE (June 17, 1:51 UTC): Adds information from Alchemix's incident report.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is an award-winning media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. In November 2023, CoinDesk was acquired by Bullish group, owner of Bullish, a regulated, institutional digital assets exchange. Bullish group is majority owned by Block.one; both groups have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary, and an editorial committee, chaired by a former editor-in-chief of The Wall Street Journal, is being formed to support journalistic integrity.