YieldBlox Incident Roundtable
This was a roundtable discussion for a Friday community call. In attendance was Emir, Row_Bear, Noot, Serge (?), a few others, and Esteban.
We discussed the rekt Ethrefuse pool which hit their routing yields. These notes reflect Esteban's remarks.
Neobank wallet providers have their own vault.
Wallet providers were just leaving all assets in GeoBlocks pool.
- Had more layers of risk (Blend has different layers).
- Every time you add a new asset, it adds trouble opportunities.
- More risk, thus had highest return (maybe twice as much... 8–10% vs 15–20%).
It was on the developers to figure allocation.
They made a vault for asset management trustlessly.
- Vault manager can execute emergency withdrawals.
- Emergency manager unwinds position from risky pools.
- Could've identified the attack with a risk management system since the attack happened over one hour (their vault users could've lost less).
Some user tx withdrew before the rebalance or liquidations.
You can choose different strategies or assets in DeFindex.
Nobody uses the available multi-asset vaults.
You can choose strategies for each asset. USDC had 2 main options. The DeFindex fixed pool and the YieldBlocks ultra yield pool strategy.
Some (most?) devs did a 50/50 split.
The DeFindex pool is simpler and just rolls all yield in.
This is done by wallets without a default setting.
OMG the wallets get a cut of the yield.
10–15% loss for the pool.
So a 7% loss without SDF.
That would be 14 without the split.