First and foremost, we are deeply thankful to all community members for their patience and participation throughout the claim process for Elephant Money. All these discussions have given useful insights to the InsurAce team on how we can improve insurance products within the DeFi space, as well as ensuring all users get what they deserve.
Let’s review the Elephant Money event to provide a better understanding of all the steps that we took.
Elephant Money suffered an attack on April 12, 2022, 04:49:33 PM +UTC on its Reserve. This incident was due to flawed logic allowing for arbitrage between the PancakeSwap Liquidity Pool and the Elephant Reserve. The hacker used a flash loan to trade for thousands of ELEPHANT governance tokens while minting TRUNK stablecoin. During the mint stage, ELEPHANT token price was uplifted due to embedded buyback mechanics and liquidity depth was increased for both ELEPHANT and TRUNK tokens on PancakeSwap. The hacker then took a profit by selling the inflated ELEPHANT token on PancakeSwap and redeeming TRUNK tokens from the Reserve, extracting a large amount of BUSD and ELEPHANT tokens.
The total loss from this incident is estimated to be $11m as disclosed by the Elephant team in their official blog: https://medium.com/elephant-money/reserve-exploit-52fd36ccc7e8
Detailed Analysis of the Hacking
This attack was implemented with this transaction:
https://bscscan.com/tx/0xec317deb2f3efdc1dbf7ed5d3902cdf2c33ae512151646383a8cf8cbcd3d4577
Below is a step-by-step breakdown provided by auditing firm PeckShield:
Hacker address H1: 0xbceda90b2880fea5d511d54716229145508996da
Elephant Reserve address C1: 0xd520a3b47e42a1063617a9b6273b206a07bdf834
Step 1: Attacker borrowed 131K WBNB and 91M BUSD using a flash loan.
Step 2: Swapped 131K WBNB to 37,972,517,886,502.22 ELEPHANT
Step 3: C1 minted TRUNK token with 91M BUSD
– Mint 90,124,650 TRUNK to H1
– Swap 22.5M BUSD to buyback 3,050,142,559,411.813 ELEPHANT from PancakeSwap
– Deposit 3,050,142,559,411.813 ELEPHANT to Treasury_af09
- Swap 250,000,000,000.0 ELEPHANT to 4956 WBNB
- Add Liquidity 250,000,000,000.0 ELEPHANT and 4956 WBNB on PancakeSwap
– Mint 910,407 TRUNK to C1
– Add Liquidity 910,407 TRUNK and 902,123 BUSD on PancakeSwap
Step 4: Swap 34,244,200,239,512.18 ELEPHANT to 163,782 WBNB (to profit from reverse swap)
Swap 45,000.0 TRUNK to 44,156 BUSD
Step 5: Redeem with 90M TRUNK
– Burn 90M TRUNK
– Withdraw 66.8M BUSD to H1, 64,450B ELEPHANT to H1
Step 6: Swap 140,806B ELEPHANT to 21,701 BNB and 28,268 WBNB to 12M BUSD.
An independent analysis was also conducted by auditing firm Blocksec: https://twitter.com/BlockSecTeam/status/1513966074357698563?s=20&t=MfMn1AHebxYvS7LJA6JD1A
InsurAce.io’s Response Measures
This incident was spotted by the security community and our team was notified immediately. We reached out to the Elephant team at the first moment to gather more information, including a direct call with the Elephant founder to discuss and strategize our next steps.
Thereafter, we facilitated the liaison between auditing firm PeckShield and Elephant team, where they offered a code review and tracking support for loss funds to the team with contingency cases.
Each day, we kept our community updated with all the incident details to the best of our knowledge. Subsequently, based on our users’ discussions, a claim voting process was proposed where Elephant users have the option to vote if the attack was advised as claimable or not. All details are revealed in this blog post: https://www.insurace.io/blog/?p=2615
This attack resulted in approximately $11M loss of funds in the Elephant Treasury causing the stablecoin TRUNK to lose its peg and, leaving users unable to fully redeem underlying collateral. The loss is due to flawed logic in the mint function of the Elephant Reserve smart contract; hence it is advised that this hack is deemed a claimable event according to the cover wording or our “smart contract vulnerability” cover wording:
https://files.insurace.io/public/en/cover/SmartContractCover_v2.0.pdf
Every user eligible for the claim request were required to submit within 7 days after the official announcement of the attack. Also, those claims without sufficient Proof of Loss were rejected without proceeding to community voting.
For this particular attack, Proof of Loss could include, but was not limited to:
- transactions to prove the total amount of TRUNK minted; and/or
- snapshot of the impacted wallet address’s balance of TRUNK in staking pool with display of wallet address and amount of deposits, rewards, withdrawn and rolled; and/or
- transactions to show the amount and value of TRUNK sold after the attack; and/or
- other evidence as deemed necessary
All claims were assessed and voted by our Claim Assessors (token holders) following our claim process to decide which claims were going to be paid on a case-by-case basis.
Read more about our Claim Assessment Process and How to Make a Claim
Community members were deeply engaged in debate during those days, emerging 2 distinct opinions which we would like to highlight.
Opinion #1: Claims Violate Cover Terms and Should Not have been Paid
Elephant users stake their collateral (BUSD) to mint TRUNK tokens, which is an algo-stablecoin; however, during the exploit, there was NO loss to the number of TRUNK tokens held. This incident could be deemed a devaluation or de-pegging. Users have no ownership on the BUSD collateral, as these funds belong to the Elephant protocol already. This view is also supported by the Elephant Money team.
As such, claims cases are not in line with the cover wording, including:
- Clause #2 under “Coverage” – “The loss of insured crypto assets is permanently irreversible with no means of repayment or recovery by any parties in the future. It can be in form of being moved to another address or addresses, which the insured cannot access or control permanently;”,
- Clause #4 under “Exclusion” – “Any losses due to devaluation of insured’s assets, regardless of such devaluation is related to the attack or not; or”
Users who panic sold TRUNK tokens after the hack were responsible for bearing the loss themselves, and those who continued to hold TRUNK tokens had a chance of recovering their loss as the Elephant team rebuilds the protocol’s treasury and the TRUNK peg.
In short, this event shouldn’t have been covered because there was no
- Loss in control; and
- Token price devaluation is not a covered event under smart contract cover
Opinion #2: Claims Were Eligible Due to Treasury Loss
Policies should be claimable as Elephant users have incurred losses. TRUNK tokens have been devalued because the protocol treasury shrunk due to the hack. The assets backing the TRUNK token’s peg have been exploited, leading to the TRUNK token’s fall in price.
The preliminary compensation plan proposed by the InsurAce.io team is slightly in favour of this proposed interpretation.
Detailed records of the covers and statistics are summarized in this Excel: shorturl.at/cnCO3
As part of InsurAce.io’s current claim process, the 1st claim payout layer will be 20% of the premium pool (around $1.97M currently) before the underwriting capital pool is hit.
After the claim plan voting process, the results were:
85% for
15% against
As shown in the image above, 1,872,394.5154 $INSUR voted to accept our proposal to pay out the Elephant Money claims, which was BUSD 98,092.64 in total.
On 6th of May, we proceeded to offer claims payouts to all of the 9 individuals without voting any further. The compensation amount was calculated, confirmed with the cover holder individually, deposited into InsurAce.io claim system and distributed accordingly.
We did up a blog post to guide Elephant Money users on how they could receive their payment. Check it out here: https://www.insurace.io/blog/?p=2898
Pingback: Now might be a good time to think about crypto insurance - News Bazzar