LST Isolated Pool Oracle Incident

Summary

On December 10th, 2023, the Venus Liquid Staked BNB pool experienced a shortfall of approximately $274,000. This incident occurred due to a malfunction in the SnBNB Oracle, which saw its price inflated to $77 billion. This allowed an exploiter to utilize a small position of ~0.5 SnBNB to deplete the assets available in the pool.

The impact on the Venus protocol was confined to the funds in the LST Isolated pool, ensuring that no user funds in other pools were compromised during this event.

Incident Timeline

Impact Assessment

Following the surge in the SnBNB Oracle price to over $77B, the exploiter was able to utilize ~0.5 of SnBNB collateral to borrow the entire available liquidity from the LST Isolated pool, with the following breakdown:

Asset Amount USD value
BNBx 654.22 $168,370.06
WBNB 275.0 $65,940.48
AnkrBNB 108.76 $27,855.61
stkBNB 46.84 $11,642.08

Risk Assessment

Since the identification of the exploit, Chaos Labs has diligently monitored the protocol, which continues to function as expected. We have confirmed that other pools remain unaffected and have detected no unusual activity.

In collaboration with the Venus and Binance teams, we are thoroughly analyzing the potential impact on other assets, particularly in light of their reliance on the Binance Oracle.

Recommendations

To ensure maximum safety, we have advised temporarily suspending all operations involving assets that depend on similar configurations. This precautionary step should remain in effect until the investigation into the Oracle malfunction is fully concluded and any necessary corrective actions have been implemented.

With this in mind, the following markets have been paused - stkBNB, SnBNB (LST pool) and agEUR (Stablecoin pool)

2 Likes

In response to the abovementioned incident, the community has made the following Governance proposal to remediate affected users as early as possible while we work on recovering funds with our partners:

VIP-214 Repayment of the insolvency in the Liquid Staked BNB pool - stage 1

Summary

If passed this VIP will perform the following actions:

Details

Due to the incident explained above, the following insolvencies have been generated in the Liquid Staked BNB market (Venus Protocol) (defined in full tokens):

  • ankrBNB: 108.890115080027695179 ($28,089.03 assuming the price $257.95758234)
  • BNBx: 654.859606916027127141 ($169,444.84 assuming the price $258.74987025)
  • stkBNB: 46.88799297198450373 ($11,733.84 assuming the price $250.2525884)
  • WBNB: 275.071884556669618361 ($66,127.28 assuming the price $240.4)

The USD prices are the valid ones at block 34241940, when the insolvency was recorded (https://bscscan.com/tx/0x9b76f9a17c48bd744038a2adfd657cb36d2c4d452a251f0a35132534fd1d22d3). The total insolvency, considering those USD prices, is $275,394.99. This VIP proposes to send 300,000 USDT to the Community wallet to have some margin and absorb potential changes in the USD prices before the VIP is executed.

This VIP is part of the mitigation plan. Specifically, this step is:

  1. Transfer USDT tokens to the Community wallet (this VIP)
  2. The Community wallet will swap needed assets to cover the generated insolvency. If due to price fluctuations some USDT are not needed, they will be sent to the Venus Treasury. If the USDT transferred is not enough to buy 100% of the needed tokens, the new scenario will be reevaluated.
  3. The Community wallet will send the swapped tokens to the Venus Treasury (https://bscscan.com/address/0xf322942f644a996a617bd29c16bd7d231d9f35e9)
  4. A new VIP will be proposed to remove the insolvency from the affected markets, injecting into the markets the tokens previously received in the Venus Treasury

Vote :point_right:t2: Venus Protocol