Last night, some unusual price action on CVX was brought to our attention. This came from an address which had just swapped 46M USDM to DAI in a factory pool.
After some research, along with Yearn and Convex, we realised those were the actions of the person behind the Mochi protocol.
- Mochi used bribes in their own token (MOCHI) to vote in a gauge receiving CRV
- Mochi incentivised votes to its gauge via Convex until the factory pool reached $100m liquidity
- Mochi minted a huge amount of tokens to themselves, Mochi has no minting cap or tokenomics
- Deposit those tokens onto the MOCHI which has a custom price oracle set by the Mochi team (meaning the Mochi team could mint as many tokens as they wanted if there was enough liquidity to trade it for stables that aren’t backed by air) and 90% LTV and mint $46m USDM
- Swap those USDM to DAI on Curve
- Use those DAI to purchase Ethereum and ultimately buy 1.05m CVX
- At that point, several people aware of the situation including Andre Cronje and myself tried to warn Mochi against locking those CVX as they would have been in a position to unfold their position and make LPs of that pool whole if the acquired CVX had remained liquid.
- Mochi eventually locked the CVX
Few more bits about Mochi and findings:
- 99.5% of the circulating supply is owned by “the team”
- This likely means USDM undercollaterized
- There are serious security and decentralization conderns with Mochi and Azeem
- Those newly purchase CVX wil likely be used to give the USDM pool more incentive eventually creating more liquidity for the Mochi team to sell their undercollaterized USDM to LPs unaware of the situation
As this constitutes a clear governance attack and the emergency DAO deemed the LPs in that pool to be at risk, the emergency DAO agreed to kill the gauge so it stops receiving CRV emissions immediately. Those locked CVX would undoubtedly be used to deepen liquidity in the USDM pool to recreate the attack with Curve LPs left holding the bag and we urge Convex governance to take action against Mochi.
This is a good reminder that blindly accepting money from protocols for gauges or veCRV weight is a risky business especially with anyone being able to deploy Curve pools in the factory.
Permisionless pool factories and permisionless gauges are meant to empower governance which comes with serious responsibilities.