An update on the Algofi bug bounty case

OP (May 4)

It has been over two weeks since your latest email and the promise of commitment to addressing the concern. What’s the plan and ETA for the next step?

Algofi (May 8)

Are you open to drafting an alternative proposal using the alternative ideas you’ve posted on this thread? I think it…

OP (April 20, 2023)

The proposal voting window has ended and this proposal didn’t receive enough votes. As you can see in the following exchanged emails, there will be another proposal and the appropriate change is still expected to be applied per the Algofi team’s confirmation.

OP

Ok, now the topic is submitted but…

OP (April 7, 2023)

The Algofi proposal for the minimum change agreed upon above:

OP (March 28, 2023)

Temperature check post: This is the post: Change STBL2 collateral factor to 0% - Temperature Check - Algofi Governance

Algofi Response (March 27, 2023)

We’ll revert to your latest email by the end of the week. The team feels that we’ve been clear in answering your concerns and disproving proposed attack vectors during this process. What has been the community response to your proposed attack vectors?

My Response

We’ll rever…

Algofi Response (March 24, 2023)

The STBL holders (long positions) are definitely in a much better position than those who borrowed (short positions). They know that they will get their money eventually (can take a very long time though) and meanwhile can enjoy receiving the interest. Depending on how much they control the STBL market…

OP (March 23, 2023)

It is not fine on paper because you can create an unlimited amount of STBL by borrowing (there is a platform limit but that’s temporary and still much higher than the pool size). For example, you can deposit $20M algo and borrow $15M STBL immediately. That’s new money. So, it is not only that the liq…

OP (March 23, 2023)

One key difference with Dai is that 50+% of Dai reserve is USDC. It doesn’t mean that Dai wouldn’t suffer from some of the similar issues but that practically reduces the chances in lower market caps. At the end, all stable coins that are not fully backed by USD could suffer getting depeg during expansions…

OP (March 23, 2023)

@JohnWoods @Adri IMO it is irresponsible to encourage people to use Algofi (with including the governance rewards) unless the concerns in this thread are addressed. At minimum STBL must be decoupled from the lending protocol by lowering its collateral factor to zero.

OP (March 23, 2023)

I haven’t heard back from you for a while. This doesn’t leave me any other option but to escalate my concerns to appropriate parties and authorities.
There have been many stable coin failures until now with severe irreversible and costly consequences. I have already explained fundamental flaws and…

OP (March 18, 2023)

My latest email to the Algofi team: Any estimated time of response here? I’m hoping that we get to a conclusion before the start of the next governance round.
Given the recent events and extreme market conditions very much relevant to this bug bounty report and described scenarios, I hope the val…

OP (March 11, 2023)

My recent emails to the Algofi team: The recent unfortunate events, the theft from multiple Algo wallets and its negative impact on myalgo’s brand and future, reminded us how challenging it is to safely and securely operate, scale and survive in the crypto space. Unfortunately, no project is immune…

Algofi Response (March 2, 2023)

Thanks for your patience as we considered your recent email. Our response below: I think many of the themes in this alternate formulation are very similar so I am going to focus on the primary difference which is your claim that the attacker will be able to manipulate the interest…

OP (February 21, 2023)

Hi nlh, Thank you for the comment. From your account, I’m not able to tell whether you work for the foundation or not. Could you please clarify your role? I’m a bit unsure if this is really the right place to discuss an Algofi-bug issue. Having said that, I’m interested in learning more about this…

OP (February 18, 2023)

For posterity, I just realized that the re-written scenario in the Algofi team response is missing a step in my original report. attacker purchases 50M STBL via the open market - after this is complete, STBL borrowers are now in possession of at least 50M less STBL than they currently owe.

OP (February 18, 2023)

@Adri @JohnWoods and anyone else who is responsible for the Algo bounty matching program.

OP (February 10, 2023)

Hi Algorand community, I’d like to ask for help and your opinion on a critical Algofi bug bounty report I submitted to Algofi founders on 2022 Nov 25. After exchanging a number of emails and a few meetings during the past three months, in our last meeting today they concluded that the report does not…