Hey all, an update from our side regarding the THORChain exploit involving one of the Asgard Vaults, the latest news shared by the THORChain devs, and how it impacts us.
Key points:
- The exploit of one of the five Asgard Vaults is believed to be linked to a bug in GG20 and one malicious node.
- THORChain is producing blocks again, and native token transfers will soon be enabled.
- For full functionality, the THORChain devs are currently researching and discussing whether to either patch the GG20 issue or move to and implement DKLS.
- Withdrawals and deposits of Secured Assets remain frozen until Base Layer trading resumes.
- App Layer activity will resume, and the products will work as intended once the Nodes enable transfers again.
- Subject to Nodes vote, the path forward supported by the THORChain core team would preserve a 1:1 backing for Secured Assets.
Last night
@THORChain shared the latest information in their livestream regarding the exploit, which is now believed to be linked to a bug in GG20 and one malicious node. The team is still investigating everything and working with the relevant agencies to try to identify and catch the person behind the hack. In the coming days, the devs will work on figuring out the best path forward when it comes to security so we can move toward trading being resumed again, as well as a plan for how the lost funds will be handled, which the community and nodes can vote on.
Due to multiple node operators executing a pause, the network had been paused over the past day. Block production has now resumed, and the THORChain development team is comfortable allowing native token transfers again, which are expected to resume shortly as well.
This pause will remain in place until the THORChain devs decide to either patch the GG20 issue or move to DKLS, and implement the chosen solution. The timeline is unknown so far. Patching the GG20 issue will be much quicker, but there’s a very small risk that there’s more to it and that the issue found is not the complete story. That’s why an immediate move to DKLS is also being considered, as it is viewed as a more secure option, a clean and up-to-date implementation, and something that was already planned and on the roadmap.
What this means for Rujira users:
- Once transfers are unpaused, RUNE, RUJI, and TCY can be sent to other addresses again.
- Till trading is resumed, withdrawals and deposits of Secured Assets are not possible. Deposited assets on Rujira are expected to retain their full value, more information about that below.
- Any other activity on the App Layer resumes. We want to emphasize that everything on the App Layer is safe, that the products are working as intended, and the exploit is limited and isolated to one single Asgard Vault.
Assets deposited onto Rujira as Secured Assets are stored in the Asgard Vaults, and since there are no clear buckets, this means, on paper, it’s would be a shared loss between PoL, LPs, Trade Assets, and Secured Assets. 1/5th of the Secured Assets TVL would therefore be subject to the exploit, which equates to around $1M, with nearly half of this amount being BTC from the THORChain treasury.
While all details are not fully finalized yet, as it stands now, the path forward, as also shared in recent communication, is that THORChain’s Protocol Owned Liquidity will be used to compensate Trade and Secured Assets so users are made whole. This means that Secured Assets on Rujira are expected to retain their full value, and withdrawable once trading resumes on the Base Layer.
With the launch of bRUNE, the contract has been bonding RUNE to different whitelisted Nodes. The malicious Node wasn’t whitelisted, and therefore didn’t have any bRUNE bonded to it, but there is bRUNE bonded to the other nodes in the compromised Asgard Vault. The likely path forward here is that if the Nodes can agree and vote on who the malicious Node is, that Node’s RUNE could be 100% slashed and partially used to cover the loss, with the remaining Nodes in the compromised Asgard Vault being refunded. This means that the RUNE bonded to the Nodes via bRUNE will be safe.
Over the next couple of days, we will assist THORChain wherever we can and continue to participate in conversations to further discuss the accounting of the lost funds.
Simultaneously, there are still a lot of products to build and improvements to make, and the world still deserves a fair and decentralized financial system, so we are not going anywhere and will keep building. You can continue to expect updates from us as usual.
If there’s any news regarding the exploit and the next steps, we will keep the community updated. We will also share once Native assets transfers and activity on Rujira is resumed.