Summary:
This proposal is to deploy CRV from the community fund, as outlined in the Vest-Split Github repo, to repay LPs affected by the Curve pool hacks in July 2023. The affected pools were alETH/ETH, pETH/ETH, msETH/ETH, and CRV/ETH.
Abstract:
The total amount of CRV in the Community Fund is 123,915,151 CRV. The amount proposed to vest toward LPs in the affected pools is 71,768,597.75 CRV, which will vest linearly over a year to the amount of 196,626.29 CRV per day.
CRV for this purpose must come from the Community Fund and the contract code enforces a minimum 1 year vest on all CRV withdrawn from the fund. The CRV linearly vests from the Community Fund over 1 year by deploying vesting escrow contracts to respective VestSplitter contracts. These contracts were deployed as a noncustodial solution that allows affected users to claim their share of the overall vest.
The per-user share was calculated over the past months based on the LP balances held by addresses just before the hack and filtered for smart contracts to determine the ultimate beneficiary of the LP balance. The data processing was publicly shared on the Curve-Snapshot Github repo with the final values pushed to the scripts folder of the Vest-Split Github repo. Affected LPs have been encouraged to review the csv files and make sure the values accurately reflect their exposure. The values in Vest-Split determine the pro rata share of the overall vest that each address is entitled to.
Each protocol has handled the recovery situation differently, and the calculation of the recompensation requirements is described individually below. In general, LPs have experienced loss denominated in ETH (also in CRV in the case of CRV/ETH). A fair value of CRV/ETH on December 13 was taken to calculate the quantity of CRV required to vest to each VestSplitter. CRV is a volatile asset and is vested over 1 year, so there is no guarantee that LPs will be completely recompensated in $ terms, or they may be over-compensated, depending on unforeseeable market conditions.
Motivation:
The Curve TVL at the time of the hack was ~$4B, with the value unrecovered making up ~1% of overall TVL. While stolen funds in each pool were either completely or partially recovered, MEV bots have left all affected pools with a shortfall, and this remediation proposal seeks to make affected LPs whole. The Curve team has been working with each affected protocol team for months in the aftermath of the hack to develop an equitable process for recompensating victims and they believe this arrangement is in the best interest of Curve DAO and its users.
Specification:
Curve
The losses in the CRV/ETH pool have been partially recovered. The losses calculation took the amount of ETH and CRV in the pool just before the hack plus missed CRV emissions that would have been distributed to LPs since the hack (an assumption if the pool existed until today) and subtracted the ETH and CRV that was partially recovered.
The overall ETH to recover was calculated as 5919.2226 ETH, the CRV to recover was calculated as 34,733,171.51 CRV and the total to distribute was calculated as 55’544’782.73 CRV.
JPEGd
The spreadsheet of JPEGd’s calculation for repayment can be found here.
JPEGd’s recovery strategy has involved their DAO treasury fully repaying all the JPEG’d users. That means either borrowers or people in the JPEG’d autocompounder. The remaining users to reimburse (who have been partially repaid by JPEGd DAO from funds recovery efforts) include the LPs in 3 pools that were impacted by the exploit: pETH/ETH, JPEG/pETH and JPEG/ETH.
Note that JPEGd plans to propose an arrangement with Curve to recompensate losses incurred to JPEGd DAO whereby the Curve Grant Council transfers CRV to a Curve DAO-controlled wallet and the DAO votes to transfer that amount to JPEGd. They intend to max lock the full amount in that arrangement. That is a separate proposal, but briefly mentioned here for context about the intended repayment arrangement.
The overall ETH to recover was calculated as 613.53 ETH and the CRV to distribute was calculated as 2’157’132.57 CRV.
Alchemix
Alchemix has able to partially recover funds lost in the alETH/ETH hack. The Alchemix DAO has custody of the recovered ETH and alETH, which they will distribute to affected addresses. The difference between the quantity of ETH and alETH just before the hack and the amount recovered was used to calculate the amount of ETH required to recover. alETH was calculated as being at parity with ETH at the time of the exploit.
The overall ETH to recover was calculated as 3567.8151 ETH and the CRV to distribute was calculated as 12’544’211.6 CRV.
Metronome
The spreadsheet of Metronome’s calculation for repayment can be found here.
Metronome was able to partially recover funds lost in the hack, amounting to 80.86%. The amount to recover was calculated by taking the values in the pool just before the exploit minus the amount recovered.
The overall ETH to recover was calculated as 433.02 ETH and the CRV to distribute was calculated as 1’522’470.85 CRV.
Vote
The DAO vote is live here