The Vyper throws a curveball at the Curve (exploit)

To the chagrin of many DeFi proponents, Curve, a revered blue-chip money market in the ecosystem, was exploited this past week. This was not their fault but because Vyper, a Python-based smart contract language for EVM, did not correctly implement a reentrancy lock, which allowed bad actors to repeatedly re-enter a contract. This resulted in ~$70m in liquidity drained, in which ~$45m was drained from 4 liquidity pools on Curve. As a result, $CRV plummeted from its $0.70 – 0.80 levels, to hit a low of ~ $0.08 at one point.

Domino effect of the Vyper’s long tail 

Although Curve’s potential fall and token price would be devastating, the longer-tail risks are much more concerning. Curve Founder Michael Egorov had ~$100m in loans backed by 427.5m $CRV (~47% of CRV circulating supply) on various (dominant) lending protocols such as Aave and Frax – 305m ($171m) $CRV backing a $63.2m USDT loan and 59m ($33.1m) $CRV supplied against 15.8m FRAX of debt. While this was happening, there was a huge price differential of $CRV between various DEXes and CEXes, spurring traders to capitalize on potential arbitrage opportunities. 

Due to Fraxlend’s time-weighted variable interest rate, Egorov’s position on Frax posed a larger risk to CRV, with his interest rate doubling every 12 hours, assuming collateral and debt positions remain the same, and that his utilization rate remains at 100%. At the time of his distressed position on Frax, Egorov’s 81.2% interest rate on Frax would have surged to 10,000% in a span of ~3.5 days. Egorov attempted to decrease his utilization rate twice, by paying back a total of 4m FRAX in the span of 24h, but unfortunately, his attempts were futile due to users removing their own liquidity upon his repayment of debt. 

Organizations and individuals to the rescue

Thankfully, Egorov was able to strike OTC deals with various organizations and individuals, selling them $CRV at a discount to its spot price, then at $0.40. The vesting period and terms of the deal is supposedly for 3 to 6 months, or can be sold if $CRV hits $0.80. It is clear that for the counterparties involved, buying $CRV at a discount to spot would potentially be a profitable trade – Egorov would have the funds to repay his debts, and with confidence restored in Curve, the token would then recover in price. 

Sandra Leow, Research Manager at Nansen, shared a summary of the OTC deals and counterparties:

                 Table 1: OTC Purchasers of $CRV from Egorov (Source: @sandraaleow)

As of 3 August 11:30pm EST, Egorov has sold a total of 106m $CRV for $42.41m, having $65.34m in debt remaining:

Table 2: Summary of Michael Egorov’s Debt Positions, as of 3 August, 11:30pm EST (Source: @lookonchain)

What is evident is that many of these counterparties have a vested interest in not only a profitable trade, but also preventing the collapse of a DeFi stalwart, and hence, other key protocols in the space. It is also positive to note that Egorov is still making strides to rescue his own brainchild by repaying his debts, eventually bolstering the DeFi space from further repercussions. 

Memecoin Monitoring: “We are so back?!”

From animal racing to games

Two weeks ago, we highlighted the world’s first ever real livestreamed hamster race betting platform built on ETH and BSC. Following the $HAMS hype, many other ‘rodentfi’ projects have emerged – from hedgehog and rat racing, to rat roulette, most of which have surged, chopped, and crashed, while others have rugged. 

Retro game related shitcoins also took the spotlight for about half a day before fizzling out. Attention on $tetris, the token for an on-chain PvP Tetris game, spread like wildfire last week, surging over ~70,000% within ~3 hours, then crashing 5 hours from its peak. In an effort to capitalize on the attention on $tetris, $SNAKE, a token for a PvP on-chain classic mobile snake game synonymous with old Nokia phones, launched last Friday. Unlike $tetris, $SNAKE only surged a ‘measly’ 225.15% from launch to its peak, before tumbling down.  

Base-ically Shitcoins for now

Just when shitcoin traders thought they could catch a break, the next shitcoin play was just around the corner. The Base blockchain (by Coinbase) garnered much attention last weekend, as users bridged their ETH from ETH mainnet to Base, via a portal proxy contract. (no official frontend available yet)

With DEXes such as LeetSwap and RocketSwap available on Base, it was only a matter of time before shitcoins started making their appearance. $BALD, a memecoin based on Brian Armstrong’s baldness, was the star of the show, soaring a whopping 100x within a few hours from its launch. 

Unfortunately, it was not long before Leetswap, the (then) largest DEX on Base had some of its liquidity pools exploited (potential initial losses >$600k), causing most tokens in the Base ecosystem to plunge. Leetswap stopped trading to investigate, and since then has yet to resume operations.

As of 31 July, there is ~$65m in ETH bridged to Base, with minimal ways to bridge back to ETH mainnet. However, following the various crises on Base, TVL had fallen from ~ $40m to $10.88m as of 3 August. Base is set to be open to the public on 9 August. We would expect an uptick in Base’s TVL, as more convenient front-ends are available for users to bridge their assets over.

$BALD rapidly loses its shine

Four addresses that withdrew 0.5 ETH each from Bybit, bought 50m $BALD (5% of token supply) within 4 minutes from launch (link).  Following the surge, 37m $BALD was sold for $1.04m. A Twitter user, @cheatcoiner.eth, bought 2% of the token supply when it was under 50k market cap, turning $500 into a stunning $1.5m within a day. It was interesting that (i) the token was deployed by a whale that holds 49% of cbETH supply, that was bought on Uniswap v3, and that (ii) a substantial amount of $30m in liquidity was added to $BALD – a sign of a well-coordinated effort.

After $BALD had reached ~ $100m in market cap, the whale removed liquidity from the pools on Leetswap (but did not sell), profiting around $5.9m from supply and the liquidity withdrawal. This caused $BALD’s token price to plummet by ~7x.

Who is $BALD?

The deployer address mentioned above has a history of using leading exchanges, with the largest share of interaction with FTX, and also with Alameda in the past. Apart from that, the $BALD deployer’s Binance wallet frequently received deposits from one of the wallets that helped trigger the UST depeg

Twitter user @MikeMcDonald89 wrote that he received $50,000 in winnings from a bet on the Chess World Championships back in 2021, from an address owned by @milkyway16eth, who  sent and received large amounts of cbETH and USDC to and from the BALD deployer address. 

Regardless, as majors and large-cap altcoins have been trending sideways, the community has been finding ways to earn outsized returns, with higher risks involved. It is also evident that since the tail-end of 2022, when it comes to new chains being birthed on the mainnet, shitcoin games abound – as with Canto and PulseX, and the relatively more ‘serious’ chains like Mantle and now, Base. 

Arbitrum Stylus: A Stylish Solution

This is not new news, but back in February, Offchain Labs revealed Stylus, a programming environment upgrade for Arbitrum One and Nova. Stylus enables developers to submit contracts in WASM, and deploy programs alongside existing Solidity dApps, using traditional programming languages such as Rust, C, C++ and more.

The upgrade would allow for faster dApps to be built, as dApps written in Rust are typically faster than those written in Solidity and Vyper. It would also make fees cheaper. Another benefit, when paired with the data-saving properties of Arbitrum Nova, is that Stylus would enhance the viability of decentralized gaming. The upgrade will go live this year, but the exact date has yet to be confirmed.

We have previously seen other chains attempt to allow developers to use ‘non-native’ languages to build dApps:

  • Back in 2019, Polkadot, a Rust-based chain, enabled Solidity code to be deployed through Substrate 
  • Algorand, a Teal-based chain, allows users to build with Python wrappers
  • NEAR, a Rust-based chain, allows users to interact with the blockchain with a complete Javascript API library 
  • Cosmos, a Golang-based chain, has allowed users to build with various languages such as Solidity, SES and Pact.

Such announcements typically do not tend to impact the price of a blockchain’s token.

In analysing these chains, Electric Capital reported that from 2021 to 2022: 

  • Total developers on Polkadot barely increased
  • Algorand lost ~10% of its developers
  • NEAR’s and Cosmos’ developer count increased by ~50% on each respective chain

Hence, such measures may not actually have a huge impact on attracting developers. Instead, reports from 2022 and 2023, show developer count is positively correlated to market conditions. We expect that intuitively, an ecosystem’s developer count would also be a lagging indicator to its token’s price. 

It also remains to be seen if Arbitrum’s actions would be effective in attracting more developers – we believe that these moves are not very pivotal in increasing developer count, which would be driven more by market conditions (e.g. token price) and the overall success of the individual chain. 

More from our Library


This information contained in this website is intended as a general introduction to QCP Capital and its activities as a Digital Payment Token (DPT) service provider and is for informational purposes only.

QCP Capital is not acting and does not purport to act in any way as an advisor or in a fiduciary capacity vis-a-vis any counterparty. Therefore, it is strongly suggested that any prospective counterparty obtain independent advice in relation to any trading investment, financial, legal, tax, accounting or regulatory issues discussed herein. This website is only directed at informed and qualified investors. Your entry to this website attests that you are fully aware that trading of DPTs is not suitable for the general public and that you are an informed and qualified investor, and are also fully cognisant of all technological and financial risk(s) associated with trading Digital Payment Tokens.

In the event you intend to onboard with QCP Capital to trade in DPTs, by onboarding with us you acknowledge that you are aware of any rules and/or regulations applicable to the provision of DPT and/or financial services, the high degree of risk involved and that in no event will QCP Capital or any if its directors or employees be liable for any injury loss, claim or damage (whether direct, indirect, consequential or incidental) arising either directly or indirectly out of, or in any way connected with, the site, or its use.

If you are located, incorporated, or otherwise established in, or a citizen or resident of certain jurisdictions, QCP Capital may be unable to, or otherwise reserve its right to refuse to engage in or establish a trading relationship with you. Please contact us if you believe you have received this notice in error. QCP Capital is not registered or licensed to operate in the states of Louisiana and New York and will not be able to establish a trading relationship with you if you are resident, incorporated or have your principal place of business in New York or Louisiana.

You also acknowledge that you understand that trading in payment token derivatives (“PTD”) are also not any less risky than trading in DPTs. PTD services are not regulated by the MAS and QCP Capital is as such not licensed under the MAS to provide PTD services. You should only trade in PTDs if you are an Accredited Investor and/or have sufficient experience and knowledge in trading PTDs.

Risk Warning on Digital Payment Digital Services

The Monetary Authority of Singapore (MAS) requires us to provide this risk warning to you as a customer of a digital payment token (DPT) service provider.

Before you pay your DPT service provider any money or DPT, you should be aware of the following. 

Your DPT service provider is an exempt payment services provider pending licensing under the Payment Services Act (2019) to provide DPT services. Please note that this does not mean you will be able to recover all the money or DPTs you paid to your DPT service provider if your DPT service provider’s business fails.

You should not transact in the DPT if you are not familiar with this DPT. This includes how the DPT is created, and how the DPT you intend to transact is transferred or held by your DPT service provider.

You should be aware that the value of DPTs may fluctuate greatly. You should buy DPTs only if you are prepared to accept the risk of losing all of the money you put into such tokens.

You should be aware that your DPT service provider, as part of its licence to provide DPT services, may offer services related to DPTs which are promoted as having a stable value, commonly known as “stablecoin”.