Decentralized finance (DeFi) protocol Alchemix has resolved a bug that seemingly forgave borrowers’ loans prematurely, essentially giving them free money.
One DeFi observer on Twitter called it a “reverse rug pull,” referring to the crypto slang for when project founders abscond with user funds.
For an unknown amount of time, Alchemix borrowers could deposit ETH, get the project's alETH token in return and then withdraw the ETH used to secure their loans without having to pay them back.
"I was successfully able to borrow alETH, and take my collateral," user ptp1600 said in the Alchemix Discord server.
The issue seemingly affected the alETH pool, which was launched yesterday.
The Alchemix team said it’s investigating the issue and will publish a postmortem shortly. In the meantime, “the alETH contract has been paused and will remain so until our solution is implemented,” the project tweeted.
Alchemix co-founder Scoopy Trooples did not return a request for comment when initially contacted.
Alchemix published a postmortem of the snafu at 3:29 p.m. ET. No user funds were lost, rather users were able to withdraw ETH they should not have.
The bug started around midnight UTC, when users discovered they had “no outstanding debt even though they previously borrowed alETH at a 4:1 collateral ratio,” project admin n4n0 wrote.
It took about 15 minutes for Alchemix to halt the minting of alETH once the team started looking into the issue, n4n0 said.
The root cause: “the alETH vault accidentally created additional vaults,” the incident report notes.
The post concludes with an ask:
Alchemix’s native token, ALCX, is down 21.5% since the bug was first noticed, according to CoinGecko.
Brady Dale contributed reporting.
UPDATE (June 17, 1:51 UTC): Adds information from Alchemix's incident report.
Read more about
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.