An update on the Algofi bug bounty case

OP (May 4)

It has been over two weeks since your latest email and the promise of commitment to addressing the concern. What’s the plan and ETA for the next step?

Algofi (May 8)

Are you open to drafting an alternative proposal using the alternative ideas you’ve posted on this thread? I think it…

OP

Ok, now the topic is submitted but…

The proposal voting window has ended

This proposal didn’t receive enough votes. As you can see in the following exchanged emails, there will be another proposal and the appropriate change is still expected to be applied per the Algofi team’s confirmation.

The Algofi proposal for the minimum change agreed upon

Temperature check post

This is the post: Change STBL2 collateral factor to 0% - Temperature Check - Algofi Governance

Algofi Response

We’ll revert to your latest email by the end of the week. The team feels that we’ve been clear in answering your concerns and disproving proposed attack vectors during this process. What has been the community response to your proposed attack vectors?

My Response

We’ll rever…

The STBL holders

(long positions) are definitely in a much better position than those who borrowed (short positions). They know that they will get their money eventually (can take a very long time though) and meanwhile can enjoy receiving the interest.

It is not fine on paper

Because you can create an unlimited amount of STBL by borrowing (there is a platform limit but that’s temporary and still much higher than the pool size). For example you can deposit $20M algo and borrow $15M STBL immediately. That’s new money.

One key difference with Dai

Is that 50+% of Dai reserve is USDC. It doesn’t mean that Dai wouldn’t suffer from some of similar issues but that practically reduces the chances in lower market caps.

IMO it is irresponsible

To encourage people to use Algofi (with including the governance rewards) unless the concerns in this thread are addressed. At minimum STBL must be decoupled from the lending protocol by lowering its collateral factor to zero.

I haven’t heard back from you for a while

This doesn’t leave me any other option but to escalate my concerns to appropriate parties and authorities. There have been many stable coin failures until now with severe irreversible and costly consequences.

My latest email to the Algofi team

Any estimated time of response here? I’m hoping that we get to a conclusion before the start of the next governance round. Given the recent events and extreme market conditions very much relevant to this bug bounty report and described scenarios, I hope the val…

My recent emails to the Algofi team

The recent unfortunate events, the theft from multiple Algo wallets and its negative impact on myalgo’s brand and future, reminded us how challenging it is to safely and securely operate, scale and survive in the crypto space. Unfortunately no project is immune…

Algofi Response

Thanks for your patience as we considered your recent email. Our response below: I think many of the themes in this alternate formulation are very similar so I am going to focus on the primary difference which is your claim that the attacker will be able to manipulate the interes…

Hi nlh

Thank you for the comment. From your account I’m not able to tell whether you work for the foundation or not. Could you please clarify your role?

For posterity

I just realized that the re-written scenario in the Algofi team response is missing a step in my original report.
Attacker purchases 50M STBL via the open market- after this is complete STBL borrowers are now in possession of at least 50M less STBL than they currently owe.

1.5) att…

Before allocating the Gov DeFi rewards to Algofi

In the next cycle (gov7), which supposedly encourages people to use Algofi, the foundation should require the Algofi project to become compliant for bug bounty matching program like other projects such as folks finance …

I appreciate your attention and comments

Yes, not being completely open source is likely the reason. I’m trying to continue my engagement with the Algofi team, however so far it has been unfortunately quite disappointing.

Yes,

Because they aren’t part of the matching program (I don’t know why). Any STBL depegging or bad debt in Algofi as a major Algorand dapp severely hurts the Algorand reputation. IMHO the STBL protocol is flawed in more than one way and I have been constantly suggesting the Algofi team to consider…

@JohnWoods

And anyone else who is responsible for the Algo bounty matching program.