[Ethereum & Arbitrum One] Complete syncCash Initialization for Isolated Pool Markets

Proposals
1

This proposal completes the rollout of the VToken inflation attack fix by calling syncCash() on all remaining isolated pool markets on Ethereum and Arbitrum One. This is a maintenance-only action targeting deprecated isolated pool markets: it introduces no new features and has no impact on existing services or user funds.

Background

Earlier this year, Venus Protocol addressed a known VToken inflation attack vector through a two-part patch:

  • VIP-601 / VIP-602 upgraded the VToken beacon contract and called syncCash() to initialize the internalCash accounting variable — but only for core pool markets across the 7 non-BNB chains.
  • This left isolated pool markets on Ethereum and Arbitrum One without the syncCash() initialization, meaning those VTokens were still operating with uninitialized internal cash balances.

VIP-803 closes this gap. No new beacon upgrade is required — VIP-602’s beacon upgrade already applies to all VToken proxies on each network, since core and isolated pools share the same beacon. This VIP only needs to grant the appropriate permission and call syncCash() on the remaining markets.

Details

1. Grant syncCash() Permission and Initialize Isolated Pool VTokens on Ethereum

Ethereum has 15 isolated pool VTokens across three pools that require syncCash() to be called:

  • Curve Pool — markets in the Curve-focused isolated pool
  • Liquid Staked ETH (LST) Pool — markets in the LST-focused isolated pool
  • Ethena Pool — markets in the Ethena-focused isolated pool

For each of these VTokens, the VIP will:

  • Grant syncCash() permission to the Normal Timelock via the Access Control Manager (ACM)
  • Call syncCash() to set internalCash equal to the VToken’s actual underlying token balance

2. Grant syncCash() Permission and Initialize Isolated Pool VTokens on Arbitrum One

Arbitrum One has 3 isolated pool VTokens in the Liquid Staked ETH Pool requiring the same treatment. The VIP will apply the identical permission grant and syncCash() call for each of these markets.

Action

This VIP consists of 2 key actions, executed via the Normal Timelock on BNB Chain bridging to the destination networks:

1. Ethereum — 15 Isolated Pool VTokens

  • For each VToken in the Curve Pool, Liquid Staked ETH Pool, and Ethena Pool:
    • Grant syncCash() function permission to the Normal Timelock via the ACM
    • Call syncCash() to initialize internalCash == underlyingToken.balanceOf(vToken)

2. Arbitrum One — 3 Isolated Pool VTokens

  • For each VToken in the Liquid Staked ETH Pool:
    • Grant syncCash() function permission to the Normal Timelock via the ACM
    • Call syncCash() to initialize internalCash == underlyingToken.balanceOf(vToken)

Fork simulations have been run for both networks, confirming that after VIP execution:

  • All targeted isolated pool VTokens are present in their respective comptroller’s market list
  • internalCash equals the underlying token balance for every affected VToken
  • accrueInterest() does not revert on any VToken

Summary

If approved, this VIP will:

  • Complete the VToken inflation attack fix for all 15 Ethereum isolated pool VTokens across the Curve, Liquid Staked ETH, and Ethena pools
  • Complete the fix for all 3 Arbitrum One isolated pool VTokens in the Liquid Staked ETH pool
  • Ensure internalCash is properly initialized across all remaining isolated pool markets on non-BNB chains

We welcome community feedback on this proposal ahead of submitting it for a VIP vote.

1 Like