The hack of the wLEO liquidity pool on Uniswap was terrible, but it looks like investors won't be hurt too badly

LeoFinance announced today the results of their investigation as well as how they want to reimburse investors and move forward.

The long and short of it is that it sounds like the LPs (liquidity providers) will be made mostly whole.

The official announcement on how the team is going to proceed can be seen here:

V. Liquidity Providers and the Redistribution of Saved ETH + LEO

The people that were most impacted by this attack are the liquidity providers. These are users who took a major leap of faith and decided to wrap LEO, combine it with ETH and provide valuable liquidity to our Uniswap pool.

Prior to the hack, our Uniswap pool reached ~$430,000 USD in just about 1 month of operation. This is an incredible feat, especially for a project that only had a market cap of ~$1.5 million USD at the time.

If you go back through the unfolding of events, you'll see that many LeoFinance users and LPs caught on to this attack early. Fortunately, many of these users were able to contact other users and a large amount of liquidity was secured out of the pool early on.

Unfortunately, this attack occured in the middle of the night for many people. While many were able to get out of the pool in time, many others weren't. These LPs that got stuck in the pool until the end saw their entire liquidity balance hit 0. This means that up until today, they lost 100% of their ETH and 100% of their WLEO in the attack.

If you remember, the LeoFinance team was able to step in during the attack and rescue ~110 ETH from the pool. Along with this, we also saved 255,000 LEO from the Wrapped-LEO oracle.

Prior to the attack, LeoFinance's official team liquidity was ~91 ETH and 129,000 WLEO. The LEO team liquidity will not be claimed out of the saved ETH and LEO. Instead, 100% of this amount will go to impacted LPs.

Remember the 300,000 LEO that was set aside by the LEO Bounty fund in order to incentivize liquidity providers? There was only 1 payment before the attack which leaves 253,403.490 LEO remaining from that total.

We've decided to include this in the LP refund pool.

The past week has been spent reviewing the balances of liquidity providers. There are a lot of unique situtations - with some LPs getting out of the pool in time, some not, some unwrapping, some swapping, etc. etc.

Each case required manual review in order to determine a fair amount to refund based on the initial liquidity provided and if/how much a user was able to remove during the attack.

In the end, we've determined that refunding ~110 ETH + ~754,000 LEO to impacted LPs will result in near 0 losses for everyone who provided liquidity and wasn't able to remove any from the pool. Some users may see a varying number, but most users will be made whole.

The ETH has been sourced from what we saved from the pool + the denying of refund from the Leo team liquidity. The LEO comes from 3 sources:

Remaining bounty fund: ~253,403 LEO Saved LEO from the oracle: ~255,000 LEO Removed from the team stake: ~252,000 LEO What does this mean for the LEO supply?

This means that the LEO supply will increase by roughly 4.3% (the dev stake minting of 252,000 LEO) outside of the number that would have existed in circulation after the 90 day bounty had completed.

All of this stake would have been released in circulation anyways. No "extra" LEO is being minted. What we're doing here is simply targeting that LEO toward LPs who were negatively impacted by this event.

As many have put it, this type of hack is a black swan event. It's a make or break time for the LeoFinance project and community. The community has already shown a great deal of resilience and a strong resolve to rebuild WLEO so long as we develop a system that cannot be attacked in this way and also safeguards liquidity against other attacks in the future.

Many other projects have had to deal with major attacks such as this. These events often turn into a project fork in which the community is divided and the tokens are broken in half. Some forks go more smoothly than others. In the end, the goal is simply to reverse some of the damages and create a positive path forward to keep building the shared vision.

This event is LeoFinance's black swan. We've experienced something that could easily kill any other project. Stop them from achieving their vision dead in their tracks. Instead, the LeoFinance and Hive community stepped up on the day of the attack. Our resolve actually strengthened and we all bonded over a shared loss.

After discussing all of this with several community members and team members, it seems that this is the best path forward. A way in which LPs can be made whole and a way in which LeoFinance can thrive moving forward as we carry this extremely vital lesson and battle scar into the next iteration of WLEO and also adopt better practices to apply to current and future branches of the LeoFinance project.

On the date that this paper is published, the LP refund distributions have already started rolling out. If you were impacted by the pool attack, you will find ETH in your LP address and LEO in your HiveLinked address in the hours that follow.

If you are a member of this group, we just want to say thank you for being a part of this community project and also for being patient with these finalized distribution numbers.

I know many of you have been anxiously waiting to get more info about if there will be a distribution and for how much it would be. It took several days to find the concrete numbers and then also make a decision on how the distributions would occur. We hope that you find our decision for redistribution fair for everyone involved and if you have any questions related to this or anything else, don't hesitate to jump in our Discord server, leave a comment on an @leofinance post or ping us on Twitter. Thank you.

The long and short of it...

The good news here is that LPs are going to be 'mostly' made whole and the process of being made mostly whole has already begun as they are shipping out LEO and Ether as we speak.

What that 'mostly' wording means is an unknown at this time.

The bad news is that the supply will increase slightly.

In my opinion though, the increase in supply was always coming anyways and the goodwill/confidence gained from reimbursing investors more than makes up any slight increase in supply.

The other good news is that the team is planning on moving forward with wLEO 2.0, which would be pretty difficult if not impossible without reimbursing original investors.

It sounds like they have learned a lot since the original launch and subsequent investigation, and will make this one next one exponentially more secure.

It's unfortunate that wasn't the case the first time, but sometimes the best teachers in life come from the biggest losses.

And all in all, this one ended up being a lot less costly than it otherwise could have been.

Onwards and upwards LEO!

Stay informed my friends.

Image Source:

-Doc

Posted Using LeoFinance ^Beta