TLDR 📃

• DeFi continues grinding higher, awaiting a breakout; despite exploits and the shutdown of a promising cross-chain protocol.
• SushiSwap was exploited for $3.3 million. Sushi says it intends to reimburse those who suffered losses.
• Yearn Finance lost $11.6 million in an exploit.
• Acquired by Alameda Research last year, Ren Protocol has now shut down its network and transferred its assets to FTX.
• Share this report with your family & friends!

Disclaimer: Not financial or investment advice. Any capital-related decisions you make are your responsibility and yours only.

DeFi Overview 👀

DeFi TVL has generally tracked BTC price action. But Ethereum has had a big week thanks to the Shanghai Update, which has also helped boost DeFi.

Overall, the data points are clear indicators that DeFi is continuing its slow steady rise - even during bumpy weeks like this one. 

Liquid staking has remained strong despite the Shanghai upgrade. Doomsayers voiced fears that users would withdraw en masse. But top protocols like Lido aren’t even supporting withdrawals until next month. 

The longer-term effects of Shanghai on DeFi are not apparent yet. 

Keep your eye on the ball:

• BTC price action.
• Liquid staking participation - watch for outflows.

Key developments 🔑

• All of Ren Protocol’s assets are being transferred to FTX. Alameda acquired Ren in February 2022, and now the network is shut down. It looks pretty bleak for Ren. There have been movements within the community to attempt a revival, but news of the asset transfer has thrown a spanner in the works. The DeFi world continues to feel the effects of the FTX/Alameda scandal.
• Investment in blockchain gaming and the metaverse surges 12.9%. Despite relatively poor market conditions this year, interest in the metaverse is growing. About $740 million was poured into the sector in Q1 2023 - an increase of 12.9% over Q4 2022. Growth in the metaverse will inevitably spill over to DeFi protocols, particularly infrastructure. Bridge usage, for example, should begin to rise in response to this increased investment.

Hot Narratives 🔥

Big exploits rock DeFi

There have been two big exploits in DeFi this week. Over $14.9 million has been lost between SushiSwap, Aave, and Yearn Finance. To see three of the major protocols get rekt in the space of a week is traumatic for DeFi. But, these events are to be expected in a growing market with tempting targets, and exploits are not completely avoidable. To say that these exploits prove DeFi is essentially flawed and vulnerable is unfair. These events are really a symptom of how young the sector is.

YearnFi/Aave

DeFi yield aggregator Yearn Finance took a hit today as exploiters made off with $11.6 million (that we know of). Blockchain security firm PeckShield Inc. notified Yearn and Aave of the malicious transaction:

It appears the vector was a flash loan attack. The exploiter was able to mint ludicrous amounts of Yearn USDT - yUSDT - and swap it for legitimate stablecoins. Initially, it was believed Aave was also exploited, but this is not the case. The old v. 1 version of Aave involved in the exploit has been frozen since December 2022. Aave v. 2 and v. 3 are confirmed safe and unaffected. 

As the situation is still developing, we are unable to provide a lot of detail. What we do know is that the hacker sent funds to TornadoCash - to the tune of ~1,000 ETH.

It appears unlikely that these funds will be returned.

SushiSwap

SushiSwap, an Ethereum-based DEX, was exploited for about $3.3 million on the 9th of April. The exploiter used a bug in a newly implemented contract to imitate a Sushi pool. This tricked the protocol into giving funds to the exploiter. Twitter user @0xfoobar breaks down the attack vector here:

The new contract was implemented within the last two weeks. Since the code was essentially copied and pasted from Uniswap, the Sushi devs failed to alter it to fit its new usage. This means we can chalk up the exploit to a familiar vulnerability: a dev error. It’s important to remember that a perfectly coded contract is essentially uncrackable. Human error is why most attacks are successful, not some fundamental weakness that is unique to DeFi.

Some users were affected directly. Those who had approved Sushi transactions and had used the protocol for swaps between the 2nd and the 9th of April were vulnerable. 

Note: It’s worth checking wallets to ensure no funds have been lost. If you have lost funds, read on to find out what to do.

Sushi has confirmed that the protocol is now safe to use and the code has been patched to defend against the exploit. 

Some of the stolen funds have been recovered. The devs posted this update:

Apparently some white-hat hackers noticed what was happening and stole some funds to safeguard them. Some of the stolen funds have now been returned to Sushi. SushiSwap says it plans to reimburse everyone, even if the rest of the funds are not recovered. 

We recommend following the asset-recovery instructions if you have used Sushi recently, just in case - especially revoking access. Although the contract is no longer active, why take the risk?

Keep an eye on the Sushi Twitter account for further details on claiming funds if you have been affected!

Crypto investment corner 📈

• Satsuma, a decentralised blockchain data aggregator, raises $5 million in a seed round.
• M^ZERO, a new stablecoin issuance platform, raises $22.5 million. 
• zkSync-based launchpad Snark raises more than 150 ETH in a few hours.
• Sei, a trading-oriented blockchain, raises another $30 million.

Other news 🔔

• zkSync-based gaming protocol DecentraBet refunds IDO and announces airdrop replacement.
• Maple Finance, a fixed-yield protocol, pumps on the anticipation of its US Treasury-linked product.
• Shiba Inu’s metaverse is set for launch before the end of the year.

Cryptonary’s take 🧠

It has been a while since DeFi has had a large exploit, never mind two in a week. The hits on Sushi and Yearn are headline grabbers, so we expect a lot of negative press over the next week or two. But like most exploits, they are just speed bumps. 

Fundamentally, DeFi has never been stronger. The rate of development and the number of protocols launching every week are testament to the ever-growing decentralised economy. 

We are watching closely for DeFi to catch up to BTC’s gains. Basically, it boils down to BTC creating a new range around the $30k region. This will give the altcoin market and DeFi the opportunity to rip. The market is awaiting confirmation that BTC will not tumble again. 

There’s never a dull week in DeFi!