A path forward for Moonwell beyond Nomad

Ideation & Discussion Discussion
1

Hello! As we recently announced, Gauntlet is going to be managing risk for Apollo and Artemis. Our focus is on Market Risk, but we wanted to jump in here to kickstart the discussion of what next steps Moonwell and the Artemis community can take concerning the assets bridged to the protocol via Nomad, which recently suffered an exploit.

Where are we at?

We wanted first to describe the state of the protocol now that action has been taken to mitigate the impact of the exploit on the Artemis community.

  1. Borrow guardians have been activated across all markets (stopping all borrowing activity), with Mint guardians being activated for all nomad assets (preventing further nomad liquidity from entering the protocol)

  2. We conservatively estimate the current bad debt in the system to be just under $10mm

  3. Existing users are unable to withdraw because of a liquidity crunch

    • Users withdrew quite a bit of liquidity across markets making it hard for other users to now withdraw their funds

image
image1492Ă—924 97.6 KB

  1. Nomad has recouped over $35mm in funds from the hack:
    https://twitter.com/nomadxyz_/status/1556681397993058304
    • The amount recovered here could greatly affect the best path forward for the protocol and we will be watching closely as more information becomes available

What’s next?

From here, Moonwell and the greater community will have a few options for unpausing markets and slowly building protocol reserves. Starting with deprecating the *.mad borrowing markets, we can unwind the current lending market positions, and eventually restart the protocol so users can begin borrowing and lending again.

We’re looking forward to continuing this discussion over the coming days as we work to formulate a more detailed recovery plan with other stakeholders and token holders. Hopefully, this update gives you a better idea of where things are and what coming this week.

6 Likes
2

Thank you for starting this important discussion. I’m very interested in what the Moonwell community thinks about the events of the past week and the path forward.

5 Likes
3

Hi @jmo. Thank you for providing the state of play with regard to events that have transpired over the last week.

Hopefully this will spark discussion for the betterment of the protocol. Gathering as much community feedback and listening to concerns are most important during this time.

2 Likes
4

  1. Mad assets seem to be trading at about 24% of their pegged value (at least just looking at USDC). The max collateral factor on Moonwell is 60%. So if we make some assumptions and say that the average bad debt position is at 50% (assuming collateral is not de-pegged). Then it seems that by liquidating you could recover roughly 48 cents on the dollar. So the bad debt should be reduced to closer to $5 mil. I am saying all of these because it seems like Gauntlet’s bad debt spreadsheet assumes mad assets are worth $0. Does this make sense and am I off on any of this?

  2. [7:32 AM]

In order to better provide community input, it would be helpful to know the weighted average health rate (assuming no depeg) for GLMR, DOT, and FRAX for just those borrowers that are collateralized with mad assets.

  1. @tate

Mad assets seem to be trading at about 24% of their pegged value (at least just looking at USDC). The max collateral factor on Moonwell is 60%. So if we make some assumptions and say that the average bad debt position is at 50% (assuming collateral is not de-pegged). Then it seems that by liquidating you could recover roughly 48 cents on the dollar. So the bad debt should be reduced to closer to $5 mil. I am saying all of these because it seems like Gauntlet’s bad debt spreadsheet assumes mad assets are worth $0. Does this make sense and am I off on any of this?

5

Mad assets seem to be trading at about 24% of their pegged value (at least just looking at USDC).

Specifically, that’s the WGLMR/USDC.mad Stellaswap pool (analytics link). The liquidity is pretty thin though such that a 100,000 USDC.mad swap has a price impact of ~5%, and for 1M USDC.mad the slippage is 33%.

The nomad asset recovery program has only had ($32,714,534.73 ERC20 + $4,019,208.60 ETH) / 190,000,000 missing == 0.193 or 19.3% worth of funds returned, so if redemption is offered (hypothetically) for the assets it’ll be for $0.193 on the dollar, not $0.24.

Further compounding things is that I don’t think the assets were all returned as the same asset that was taken (for example, someone hacking USDC out of Replica.sol may have swapped for ETH, and then returned the ETH) which presents challenges in terms of recovery plan organization for Nomad.

The max collateral factor on Moonwell is 60%. So if we make some assumptions and say that the average bad debt position is at 50% (assuming collateral is not de-pegged). Then it seems that by liquidating you could recover roughly 48 cents on the dollar.

This might be better to talk about specific scenarios. One interesting feature of the Moonwell frontend is the overrideAddress parameter which lets you get a read-only display of any account’s positions and load the frontend as if you were them (make sure to connect some wallet first or it doesn’t work).

Using that feature and taking a look at this account as an example, they’ve supplied 489,394 USDC.mad and borrowed 465,716 GLMR.

That GLMR they borrowed is currently worth 465,716 * $0.76 == $353,944.16. Even if after all the dust is settled Nomad were to offer $0.25 on the dollar for the assets (again assuming redeemability as part of their recovery plan, which has not been communicated about, and is not a sure thing AFAIK), they would need to pay back a $353,944 loan in order to unlock their collateral (worth 489,394 * 0.25 == $122,348.5), which nets them -$231,595.5, which no rational economic actor would likely do.

In terms of getting this bad debt off of the protocol, it’d need to be liquidated somehow, but it’s the same scenario - why would someone pay off their $350,000 loan to seize $122,348 worth of collateral, even with a liquidation bonus? The difference needs to be made up somewhere.

Once the recovery plan from Nomad is put into place (whatever it is), if it involves direct redemption I believe the protocol oracles can be adjusted to provide the prices for the mad assets at their redemption value, but that still doesn’t make liquidations profitable and leaves this bad debt in the protocol, it just means that the markets are assessed at an accurate price by the protocol.

Another aspect here is that mechanically the protocol’s reserves can help replenish liquidity to these affected markets.

A portion of all interest paid back to the protocol is diverted into that markets reserves, which grow over time (and are immediately available as liquidity to the market). That reserve will eventually make up and overcome this missing liquidity from the bad debt over time, although the bad loans will still remain on the books and need to get liquidated at some point.

One possibility to get the bad debt actually off the protocol is that once there’s sufficient liquidity built back up the reserves, the reserves can be withdrawn by the DAO (via the _reduceReserves function), and used to liquidate these bad loans as part of a governance proposal submitted to the DAO (the _reduceReserves liquidity that leaves would immediately go back into the liquidity pool as part of the liquidation DAO proposal). At that point the DAO would also control some nomad assets and depending on this recovery plan be able to redeem them for some value as well.

Ultimately though, until Nomad communicates about their plans for recovery, it’s basically impossible to strategize around how to get this bad debt off the protocol since it depends greatly on their plans for recovery (for example, if there was some sort of bailout plan that made people whole, this debt would suddenly be profitable to liquidate, which removes a large chunk of the problem).

3 Likes
6

Thank you for the detailed responses. I’m still learning details of the liquidation side of crypto money markets and your comments helped to fill in the gaps.

I don’t see a scenario where anyone is going to be made whole. Maybe someone more experienced could explain how that even has a 10% chance of happening but I don’t see it. It would be cheaper to fund 5 new Nomads than for someone to come in and rescue Nomad here and even if Nomad wanted to make everyone whole, I don’t think that they have the resources to do so. It seems like you can pretty confidently assume this is not going to happen even though Nomad hasn’t admitted this yet.

If you can figure out how to extract value out of the mad asset collateral currently in Moonwell I think that would be a fair hedge against an even worse outcome that has not yet been announced. 24 cents on dollar on the dollar in the open market is probably more than anyone will actually be able to redeem in the end. Also, if Nomad decides to reward those that were holding mad assets when the hack happened, it wouldn’t even matter if the tokens were sold now as far as receiving that reward?

If there is a way to get something for the mad assets now it seems like that something now is probably better than the official something else that Nomad will eventually announce. Even if Nomad is able to somehow deliver more value for mad assets than the open market is right now, it doesn’t seem likely that it would be leaps and bounds better.

Tough situation and doesn’t seem like there is an obvious way out of this mess. Good luck. I hope that my FRAX collateral will eventually be able to be withdrawn. In the meantime, 73% APY seems pretty good. Hopefully, that will eventually be worth more than just a higher theoretical value.

7

Gm, thanks for starting this thread. Full disclosure I have been significantly impacted by the nomad hack.

This is a very complex situation and as @octavius mentioned:
“Ultimately though, until Nomad communicates about their plans for recovery,
it’s basically impossible to strategize around how to get this bad debt off the protocol
since it depends greatly on their plans for recovery…”

Nomad assets were fundamental to Moonwell Artemis. They were built into the system.
There even was an icon on the Moonwell Artemis app called “bridge” that directly linked to the nomad bridge (it has, as it should be, been removed)
Please excuse how frank and crass I am being. I am just stating some things.

My belief is that for people to regain trust in Moonwell then Moonwell Artemis needs to be part of some sort of plan to try make the users whole.
Further to that, as Moonwell Artemis is fundamental to Moonbeam and Harvest moon is a “Moonbeam defi campaign” I believe Harvest Moon should also be apart of the solution as this would ultimately serve their interest by helping the Moonbeam ecosystem.

Also of note is the “loss aversion bias”, i.e. asymmetry in feelings experienced when people lose money vs gain money - people feel losses significantly more than they feel gains. So the hurt from losing money cuts deeper.

I think if people could be made whole over 12-18 months people would be happy with that.
I also believe that if people believed this then it would be good for the Moonbeam ecosystem, i.e. if it was known that Harvest moon, Moonwell, and Moonbeam are helping users get whole and a proper marketing campaign is launched on this then it could really be a positive for Moonbeam.

I also think that if this is coupled with a revised bridging solution then the Moonbeam harvest moon campaign could run again successfully. So yeah I think the solution here would also involve working on a bridging solution. Obviously it is very risky to directly associate yourself with a bridge so not sure what the way forward would be. I would think integrating native BTC, native FRAX, and AUSD (or another Polkadot native stable coin) would be the way forward. Then long term work on native USDC, USDT. Not sure on any possible solutions with wETH besides using some synth market but no idea how complex that is.

8

Ultimately this solution needs to come from the community as a whole, and I outlined some mechanical options for getting the markets back in a good state, but again, there are multiple paths here and it depends entirely on how Nomad chooses to handle this situation. Once there’s a public plan of some sort from their end, planning work within the community can begin and options presented.

One thing to note - if Moonwell had integrated aUSD/iBTC there would’ve also been absolute chaos last night as aUSD de-pegged - https://twitter.com/AcalaNetwork/status/1558785360670298112, so this sort of risk analysis/mitigation is obviously very difficult - if you utilize WETH on eth mainnet, you take on the risk that the wrapping contract might get hacked and lose the ETH backing your WETH. It hasn’t happened yet so there’s a good Lindy Effect, but as with all things risk management, nothing is ever 100% sure or safe. Polkadot is a great ecosystem because it has native cross-chain messaging (XCM) so a lot of these 3rd party risks with bridging are different/removed, but other things can go just as wrong.

DeFi as a nascent space is risky. There are risks with any protocol putting trust in any other protocol - multichain bridge has had security issues before, if Chainlink messes something up it’d be catastrophically bad, and USDC could suffer an infini-mint bug of some kind and lose peg - the list of things that can go wrong with bad knock on effects is very long.

Ultimately the way I see it is that these Nomad assets de-pegging are no different than something like the WETH contract getting hacked on mainnet or UST depegging months ago - the idea is that these protocols guarantee redeemability as part of their value proposition and that guarantee is now somehow broken, the blame lies entirely with them.

1 Like
9

Thanks for the response, @Octavius. I hope you don’t mind I have just numbered my questions to keep everything easier to follow.

Yes, I agree. Ultimately the solution should be directed by the community. In saying that,

  1. what community does not want to support a program to assist users who have lost funds?

I have not come across such before. Furthermore, this is a very complex situation with lots of information asymmetry. To me the best solution is for Moonwell artemis, Moonbeam foundation, and Harvest fund to signal their intent. I believe if they signal that they plan to do what they can to help users with lost funds regain value then it will be a net positive for these entities. After all, Harvest fund, Moonwell and Moonbeam foundation are the biggest players on Moonbeam.

  1. If I understand correctly Harvest moon fund is denominated in GLMR? Big money and clever degens do watch this sort of thing.

As previously mentioned, full disclosure I have lost a lot of money in this hack. I hope you don’t mind me asking -

  1. besides being a Moonwell moderator, what is your position with regards to this incident? Have you lost assets in the hack? Do you receive any funds from Moonwell?

With regards to Nomad assets, I think what is important here is exposure and reliance on 1 protocol. Yes, everything is 20/20 in hindsight. However integrating 3 different key assets (USDC, BTC, and ETH) from 1 technology platform will definitely been seen as a mistake looking back. It is like putting all your eggs in 1 basket. So for those that believed in Moonwell they fell victim to poor risk management by Moonwell. A better approach would be to not rely on 1 bridge. As someone who works in tardfi I can tell you 100% this is poor risk management. Again, this is very easy in hindsight. And I personally attribute blame to myself for this incident. So yes, I don’t agree with you that all the blame is on Nomad devs. I don’t even think that is relevant. This is very subjective and not black and white.

What I think is important is who is part of the solution. I firmly believe Moonwell, Moonbeam foundation and Harvest moon fund should step up to the plate. Nomad bridged assets were directly integrated into Moonwell artemis, and Moonwell directly endorsed Nomad bridge multiple times on twitter. There was even a direct link on the Moonwell artemis app page linked directly to Nomad bridge.

moonwell bridge link
moonwell bridge link1920Ă—995 123 KB

Also with regards to the community having a say. As Moonwell artemis is in its infancy, the community is not organized and it is very likely that voting power will heavily be skewed in favour of a few entities. Who decides on the proposal is very grey. Currently it looks like it is a third party organization that has been hired by Moonwell. I am not saying anything is dodgy. All I am saying is that the outcome is what is important here and not much else. I have witnessed on numerous occasions in crypto, that on the surface it looks like all the right steps are being taken but at the end of the day the big dog is the one with all the cards (control over media, information asymmetry, control over governance, and has the most resources) and who is ultimately the one who decides. I just hope all this is not just for appearances. Again I am not making any accusations and am trying not to be crass. I am just stating how I see things.

1 Like
10

#1 issue is to take care of and create a plan for the bad debt on the Moonwell protocol. That is Moonwell’s responsibility and related to the nomad hack and pricing oracle being used but not the same as the nomad hack itself.

Sucks for everyone that lost money. Crypto is risky. Making people whole that lost funds because of the nomad hack is not something that Moonwell should own or otherwise fund though.

The protocol has lost millions as it currently stands figuring out how to inject funds back into the protocol or otherwise address this so that the platform is again healthy should be the focus for Moonwell.

11

Thanks @Tate. What is your role/position in this whole thing? Just so there is transparency. If you have not lost funds, are you a significant WELL holder or where do you stand in this?

I must say I do not agree with you at all. If Moonwell does not form part of the solution then in my opinion no one will ever trust it again, at least not in any significant way, and by extension Moonbeam. Moonwell Artemis is the flagship product of Moonbeam and I believe it is critical that the Foundation and Harvest fund step in as resolving this issue will be a net gain for them.

As previously mentioned Nomad bridge was an integral part of Moonwell. They shilled it on twiiter, it had a direct link to the Nomad bridge from the Moonwell app, and nomad assets formed the backbone of the protocol (wBTC-mad, wETH-mad, USDC-mad).

If you have been in crypto for a long time then you will realize that protocols that help those that lost funds following hacks are the communities that last.

12

I’m just a user of the platform. I am supplying FRAX and borrowing GMLR. Sure Moonwell can and should help with the Nomad fallout for those that have sustained losses in various ways outside of direct reimbursement of losses. However, the direct financial responsibility for Moonwell is obviously the bad debt on the platform. This is/should be Moonwell’s financial assistance priority. That bad debt is millions in value.

Do not expect MoonWell to financially assist beyond the bad debt situation. That is unreasonable and will ultimately lead to disappointment if that is your expectation.

1 Like
13

Ok fair enough. This is an open discussion. So you have not lost funds and you are not a significant WELL holder? With all due respect I don’t really understand where you stand in this - particularly when you are dealing in absolutes and treating this very black and white, i.e. you have nothing on the line and are very much trying to direct these proposals down a very narrow route. I believe it is better to be open to solutions rather than treating everything black and white.

A protocol that shills a bridge, and integrates these assets into it’s platform is not “responsible” for the hack. But if you take a step back, and take into account that when Moonwell artemis launched it was paired with Harvest moon incentives and they did shill Nomad bridge. So those that believed in Moonwell and Moonbeam are the ones that bridged. So I believe to keep their supporters it would be in their own interest to help those that lost funds by at least attempting to reimburse the users in a meaningful way. Bad debt and helping users can be the same thing. I think it is 10 million in bad debt. Moonwell artemis is the bedrock of Moonbeam defi. If they come out of this after helping those with lost funds then it will serve their best interest. If they want to realize their FDV of over 70 million USD I believe this is their path forward.

Nomad have recouped 15% or so of bad debt. Moonbeam foundation could throw in a bit. Harvest moon fund is 100 million. Start putting these things together and adding in some clever way to reimburse users (like some sort of linear vesting schedule) and then I think you can come up with a decent solution.

14

Chip, I just wanted to mention one thing here that you might not be aware of. Adding more bridges increases risk, as the Moonwell protocol takes on the risk of all the bridges supported. So adding additional bridges beyond Nomad wouldn’t decrease risk, it would only add to the overall risk of the system. Thanks for your comments.

15

Hi Luke,

Thanks for the response. Perhaps in some sense as it decreases “attack vectors” but the way I see it is if you have all your eggs in one basket then if something happens to that basket then you are left with no eggs. Example: if you had USDC.mad, ETH-multichain and renBTC (not sure if renBTC would be possible) instead of just all mad assets? Then if there was a hack to nomad then it would only impact USDC.mad asset? I am no risk expert but I think it would depend on how you are looking at this sort of thing. I would think having all assets from 1 bridge would increase your risk of total failure, but decrease your risk of minor failure. i.e. if you have assets from multiple bridges then you increase risk of one asset being compromised but decrease risk of all assets being compromised. I also think that long term EVM chains work towards native assets so this is just a short term solution so therefore risk of total failure should be a greater concern. Easy in hindsight. I could never in a million years build what you guys have done so hats off to you guys. I am sure it is not easy.

16

I think the thing you’re not considering here is that these funds are all co-mingled (someone can supply USDC.mad as collateral and borrow FRAX), so multiple bridges or multiple derivative assets (things like iBTC or stKSM) increases the risk to the protocol as a whole. If someone finds a security issue in one of those assets (like an infini-mint bug), then it can be abused to drain the entire protocol’s current liquidity.

Even if there was a different bridge for each of BTC, ETH, and USDC with Nomad just being the bridge for BTC, this still would’ve been an issue because people would’ve used it as collateral to borrow other assets.

When the nomad hack happened, the pause guardians were activated immediately to stop all market activity to counter this very specific thing from occurring - it’s relatively unknown/not thought about given the damage, but that same vulnerability that let people drain the contract on ETH mainnet was also abusable to infini-mint any assets on any other chains as well, so people could’ve minted unlimited nomad collateral to steal the liquidity in the market.

17

Thanks @octavius. Yes, I did not consider that stuff.

However what you are saying is contradictory:

Surely this would not have been an issue because, as you mention further on, the pause guardians prevented this:

With regards to infinite mint risk:
Do the guardians watch the network for these types of contract calls?
Or would it be possible for hackers if they lumped multiple calls into one transaction?
Are there limits on how much one can add as collateral and borrow in one transaction? Particularly bridged assets? If not, then why not?
If the infinite mint event occured do you think Moonbeam would have paused (and possibly forked) the network?

18

@chip with all due respect, this is not contradictory at all and it increasingly feels like you’re not really engaging here in a constructive way or in good faith. A large majority of the replies you’ve made here and on other posts is a deluge of random questions completely unrelated to the objectives of the posts you’re posting on, to the point where the discourse system has started flagging you as spam.

I suggest that we re-center this thread on the topic at hand, and I agree with @tate here that the most pressing objectives for this specific discussion are to talk about and plan to remediate the bad debt on the Moonwell protocol so it can safely be restarted.

Largely, I still see this as dependent on Nomad signaling their intentions for these assets since it’s still unclear what path they’re going to choose for returned funds. Once they signal their intentions a practical plan can be created and iterated on to remediate this bad debt in the protocol, re-open borrowing, and deprecate these nomad markets.

1 Like
19

Again discrediting me.

I asked a specific question and now you are changing the subject.

What you said was contradictory. You are saying the infinite mint would have been issue and then later you say it wouldn’t be an issue because of the pause gaurdian. I then ask specific questions and now you are telling me that I am spamming.

I specifically asked you earlier what your positions is in this? That is relevant to the discourse. If you know where peoples interest lie then you know what their motivation is. I am assuming that you are receiving funds from Moonwell.

20

Totally agree with this, because all of the above parties were promoting to use nomad bridge to the community members. Now we are all the victims of a bad risk management plan here.

1 Like