Proposal: DeFireX stuck money - recovery - help needed from the Venus community & team

Venus Governance Venus - Governance Discussions
1

Good day everyone,

As you probably know there are 16 mln. USD stuck for several weeks now from the DeFireX project (users funds) in a contract: Information about migration and difficulties arisen in the process of its implementation. Thank you for your patience and trust! | by DeFireX | Apr, 2021 | Medium

The team contacted Binance and tried to recover those funds through Binance lost funds recovery program but since these funds are recoverable through Venus governance the appeal was rejected and the only option now is to recover those funds through the Venus governance vote and implementation of the code prepared by the DeFireX team.

Unfortunately the DFX team doesn’t have Venus tokens necessary to start and push forward the vote and we are asking Venus community to help us get those stuck funds back.

When the vote is executed and funds are recovered there will be an airdrop for those who delegates their XVS and helps the team ($300 000 proportionally between delegated XVS).

Address for XVS delegation: 0xde582596e0afcd2f33894a38d549c0d95a703c05

Proposal code (external audit by Pessimistic Security will be available in ~2 days):

We seek for understanding and help from great Venus community and the Venus team. Please help us out on this accident.

If you have any questions or suggestions please do not hesitate.

Thank you very much.

On behalf of the DeFireX team.

1 Like
2

Sounds like a scam…

1 Like
3

It is not a scam, you can check the code and onchain txns with stuck funds, very easy to see that they belong to DeFireX as well.

There are users funds stuck in the contract and they need to get them back. If you don’t want to delegate and help these people delegating to mentioned above address you can create the proposal yourself, it is also an option of course. The final outcome is what is important.

As for DeFireX team and project you can check everything here:

the project is not new and legit.

Several Venus team members including Caroline and Gabi are aware of this situation.

4

I guess it would be nice if you could provide details on what was changed in the implementation, so an average user dont have to dig into the code

    function releaseStuckTokens() external nonReentrant returns (bool) {
    // allow function to work *only* with this 2 contracts
    // 0x22b433402B65DcCbE79fE66B4990A2569aB01572 - vUSDT
    // 0x3b1A4F61bD3d7301EdBd3ea2A5E05Ede8dDA812D - vBUSD

    // additional restriction - transaction can be sent before Jul 01 2021
    require(block.timestamp < 1625086800);

    address src;
    if (address(this) == 0xfD5840Cd36d94D7229439859C0112a4185BC0255        /* vUSDT */) {
        src = 0x22b433402B65DcCbE79fE66B4990A2569aB01572;
    } else if (address(this) == 0x95c78222B3D6e262426483D42CfA53685A67Ab9D /* vBUSD */) {
        src = 0x3b1A4F61bD3d7301EdBd3ea2A5E05Ede8dDA812D;
    } else{
        require(false);
    }
    address proxyOwner = IProxyWallet(src).controller().owner();
    // on-chain proof - funds may be withdrawn only by contract owner
    require(proxyOwner == msg.sender);
    uint256 totalAmount = VTokenInterface(this).balanceOf(src);
    return transferTokens(src, src, proxyOwner, totalAmount) == uint(Error.NO_ERROR);
}
5

Fair enough, asked the team to comment on that here. They will soon but basically the code allows to extract stuck in the contract vUSDT and vBUSD of DFX users, nothing more. Here are the stuck amounts, you can see the addresses, they are the same:

BUSD:

USDT:

1 Like
6

DeFireX team opened an issue on Github: Governance Proposal: Unlock user funds in vBUSD and vUSDT · Issue #45 · VenusProtocol/venus-protocol · GitHub

1 Like
7

So is a proposal to un stuck founds of the DeFireX team?

i don’t like messing with the contract, is there any other way that they could take those funds back?

why this happened in the first place?

1 Like
8

Yes, the proposal is by DeFireX team and the issue is created on Github by the DFX dev, Venus devs are looking at it, examining but there should be no risks involved since the change is affecting only contract with stuck funds, nothing else is there. Also there is an audit of the proposal happening atm. I guess there is no other way to get those stuck user funds back unfortunately =(( (if there is please share, we just need to get peoples money back, nothing more).
Human error during migration.

1 Like
9

External audit of the proposal is done and handed over to Venus team, no security issues found. We hope DeFireX users will be able to get their funds back finally soon :pray:. In Venus community and team we trust.

10

I don’t understand this part here… All the best to the DeFireX project and the people who have lost their money - but this has nothing to do with Venus at all.

2 Likes
11

Thank You for the words of support to the team and the people. We found ourselves in a very difficult situation. As for Venus, the situation is that the money is on the balance of our smart contract in V tokens. Access to smart contract management was lost due to a technical error.

You may check proposal and new v-token implementation here Contract Address 0xde582596e0afcd2f33894a38d549c0d95a703c05 | BscScan

This proposal affects only the address of our smart contract, without affecting the rest, it transfers tokens from the smart contract to the smart contract owner. The approval of the proposal will allow people to receive their funds back.

The proposal and implementation code was reviewed by Pessimistic team: Security Review of Venus Proposal from DeFireX - HackMD

4 Likes
12

Since stuck tokens are v tokens they can be released/unlocked only through Venus governance, see the message from DFX dev above and the proposal/issue on github - Governance Proposal: Unlock user funds in vBUSD and vUSDT · Issue #45 · VenusProtocol/venus-protocol · GitHub

2 Likes
13

AFAIK Binance is ready to support the proposal as soon as the Venus dev team confirms it is safe and the proposal is out (external audit is out already). If DeFireX needs to change it according to Venus devs, it can and will be done, no problem here. Once again, the goal here is to get users funds back as soon as possible as safely as possible, nothing more.

2 Likes
14

I think that Venus is using very bad behavior with her partners and also with investors and that she does not respect the ethics from which it was born.Continuing on this path their project will lose credibility. I hope that the defirex pool problem is solved and that our money is finally released.

6 Likes
15

How did they get stuck?

1 Like
17

Contract was upgraded to temporary implementation that can’t withdraw the funds. It was OK.
But later we lose the possibility of upgrade it to new version because of changing Proxy owner to implementation.

18

Unfortuanly there are no other ways to return funds.

Added 2021-05-24
Dear Joselito. Can we count on your help? Our team asks you to pay attention to our proposal. We managed to communicate with many people of the Venus team. But without your direct support, they cannot help us. @joselito

1 Like
19

Hey guys! I’m so sorry it has taken us such a long time to answer but rest assured we (Venus & DeFireX) are working to resolve this issue as soon as possible. We are in a transition period on the Venus side but, rest assured both projects are working together to get this resolved as soon as possible in the best interests of our users and ecosystem! Do keep in mind that our own team has to run all the necessary checks and security audits. Our new team has a backlog but we will get there!

5 Likes
20

Great news! I already thought I couldn’t wait for this to happen and I could get my money back.

2 Likes
21

Thanks @Danny for this positive response. Like many other people, I have quite a lot of money locked in this smart contract. It would be just awesome if venus team could help us get our funds back.

2 Likes