Analysis of the exchange rate error, its consequences and proposed actions for the DAO

5 min readDec 22, 2021

Executive summary:

There was an error in calculating exchange rates of ibToken/Token caused by the last update of the protocol 2 weeks ago.
As soon as the WOWswap team became aware of this problem we made the decision to temporary disable deposits and withdrawals to prevent any liquidity losses for liquidity providers (LPs).
After we localized the problem and made a fix for it, we found that over the course of 2 weeks some users have been continuously exploiting the exchange rate error by withdrawing and depositing liquidity, basically stealing other LP’s funds. Two most affected reserves are USDT.e and AVAX on Avalanche blockchain. Reserves on other chains - BSC, IoTeX, Ethereum, Polygon, Solana, Heco were NOT affected.
Ironically, at the moment we stopped withdrawals, the total amount of funds stolen from the Vaults was less than the amount of deposits made by the users who practiced the abusive behavior. This is why our Vaults all together did not suffer any loss.
By airdropping ibTokens WOWswap team restored balances for all LPs, who were not abusing the exchange rate error. Other LPs who took an advantage of the protocol bug (intentionally or unintentionally) did not receive the airdrop and will have to submit their requests to the DAO. The DAO has to decide on compensating these users.
WOWswap team is very sorry for the releasing the flawed update and will take a number of actions to prevent those incidents in the future.

The exchange rate error explained:

2 weeks ago WOWswap protocol was upgraded with many new features such as limit orders, 0-cost leveraged trading, further optimization of gas usage, etc. In the pursuit of optimizing gas usage, developers tried to minimize redundant recalculations of “total debt” variable but, unfortunately, made a mistake and removed the recalculation of the total debt when users close their leveraged trading positions (when users close their positions the total debt to the liquidity pools should decrease as traders return loans).

As a result of this mistake, the total debt variable started to grow over time despite users were returning the underlying assets to the liquidity pool when closing their positions. Since the protocol mistakenly believed that larger amounts of money are owed to the protocol, ibToken/Token exchange rate became very high.

LPs who made deposits before the error suddenly managed to withdraw several times more funds that they were entitled to. Some of them withdrew funds and never came back, and few people deposited even more liquidity to further exploit the bug.

Why this bug was not spotted earlier:

The bug passed automatic tests
The bug passed screening by our CTO (human error)
The bug becomes more noticeable after significant trading volume accumulates (over time)

Immediate actions taken by the team:

First, the team blocked withdrawals and deposits to prevent losses to liquidity pools.

Second, the team identified the root of the problem and fixed the code.

Third, the team has made a thorough analysis of all transactions and made the following preliminary measures to restore LP’s balances (the final decisions will be made by the DAO):

LPs who did not make any deposits or withdrawals of liquidity during the exchange rate error will not get any extra gains or losses. Their ibToken balances stay the same, while the exchange rates will return back to normal.
LPs who only deposited liquidity during the exchange error and therefore received less ibTokens received the airdrop of ibTokens. These ibTokens are not “printed from the air” — those users actually deposited underlying assets and received less ibTokens only due to the increased exchange are. Since the underlying assets are still there and exchange rates were decreased to normal, newly minted ibTokens will reflect their actual deposits.
LPs who managed to withdraw excess funds and got away (for now) are urged to reach out to us and return it. Top 3 users who managed to withdraw the largest amounts of excess funds are:

0x1ADB67a4C80A760579378624714DC01b89E69549
0xFcedeB4Fb85aA6Ae20F60A11bAbF3D127Df94A15
0x6b131ead92D1199DFAcBD9B24c4B68D30670ee5E

The full list of wallets that took extra funds is here — https://drive.google.com/file/d/12pnO9-4hyhBEpxpAXwvlEHKPTzTTWVvC/view?usp=sharing

Many wallets lead to Binance and other centralized exchanges, so in case the funds are not returned before the end of the year the DAO will make inquiries and necessary legal actions. Users who return the funds to WOW deployer 0xAe126B90d2835c5A2D720b0687EC59f59b768183 before the end of the year will receive 25% bonus cash-back in $WOW tokens.

4. LPs who have been withdrawing extra funds but later deposited even more liquidity to steal (intentionally or unintentionally) from their fellow LPs did not receive the airdrop of ibTokens, which means that they are now facing the loss due to the unfavorable ibToken/Token exchange rate that they tried to take an advantage of.

WOWswap team thinks that it’s not up to our team to decide how these users should be compensated: since the protocol is governed by the DAO, the DAO should decide what to do with these users in general or how to investigate each case individually. In theory, these users can be fully or partially compensated with $WOW tokens either from the team’s allocation or the DAO’s liquidity mining allocation or the mixture of both.

After we receive official claims from these users we will set up a snapshot voting for DAO members asking all members to cast their votes.

Next steps:

If you believe that you are entitled to further compensation, please, submit this claim form — https://forms.gle/deFsADdDcnJGzrJj8

Please, do not send messages in the telegram chat regarding your claims — you might get offers to help from scammers and your messages might be lost. Please use only the official claim form.

The team will verify and submit all your claims to the DAO for voting via Snapshot.

Suggested timeline:

31 Dec 2021 — the deadline for submitting claims via the form and collecting necessary details.

1 Jan 2022 — 15 Jan 2022 — voting by the DAO on all claims.

Final thoughts:

WOWswap team sincere apologizes for releasing the flawed protocol update. 🙏🙏🙏😥

We will make sure that all future updates undergo much more rigorous testing according to new internal procedures.

In particular, we are going to implement the following measures (we will update you separately when it’s done):

We will hire a QA engineer to focus specifically on liquidity deposits and withdrawals across all chains and all assets.
We will roll-out an automated monitoring system that will be checking 24/7 ibToken exchange rates and notify us immediately about all significant changes in them and other critical protocol parameters.
We all want new features ASAP, but starting from today all protocol’s new features and updates big or small (except critical fixes, of course) will go though a minimum 3-day testing period before going into production.

Sincerely,

WOWswap