Post Oracle exploit and BonqDAO 2.0
Actions required from users
On February 1st, 2023, the protocol was attacked. The attacker was able to change the ALBT price feed (one of the whitelisted asset used as collateral), mint 100 million BEUR, change the ALBT price again, liquidate all ALBT into their trove, drain the protocol’s liquidity on Uniswap and redeem other collateral in the remaining troves. Bonq protocol has been paused.
Recommended course of actions
Withdraw any Trove collaterals that were not affected and any BNQ balances latest by February 20th, 2023.
Bonq repaid all debts on the remaining troves, so collaterals can be withdrawn! Any other actions, that are not officially communicated is adviced to withhold on them!
You can read full hack report on the following link:
Please follow next video guide and the spreadsheet link below, where you can find your Trove contract address owned by your wallet address.
Printout is dated on February 3rd, 2023
Link to spreadsheet:
Data for BNQ airdrop_ troves, LP, BNQ - Feb 21, 2023.xlsx
34KB
Binary
- Connect Metamask and connect to the address with which you interacted with the Bonq protocol
- Copy the address by clicking on it
- press
Ctrl+Fon Windows or Linux orCmnd+Fon Mac - paste the address into the search window
- on the line with your address, copy the trove address in column B
- paste the trove address in the search field and press
enter - check that the contract has a balance in the correct token
- click the
Contracttab - click the
Write Contractbutton - click the
Connect to Web3link and connect your wallet- make sure that the correct address is connected
- click the
3. decreaseCollateralheader - Open Metamask and copy the address again
- paste the address into
_recipient (address)and_newNextTrove (address)fields
- go back to the spreadsheet with the list of troves Do not close the polygonscan window
- on the line with your trove’s address, copy the amount in column
D
- go back to polygonscan
- paste the amount into
_amount (uint256) - click the
Writebutton and if everything is greenConfirmin the wallet
- refresh the page on Polygonscan and check that there are no more tokens in the balance
- once the transaction has been confirmed, you received the collateral tokens. Check the transaction in Polygonscan to make sure
Link to video guide for Trove withdrawals via Polygonscan:
All you need is your wallet address and follow next guide.
Link to spreadsheet:
Data for BNQ airdrop_ troves, LP, BNQ - Feb 21, 2023.xlsx
34KB
Binary
- click on
29. stakes - copy paste the address from Metamask into the input
- It is best to copy from Metamask as you must use this address for the withdrawal
- click on the
Querybutton - click on the result and copy the Wei amount (the first in the list)
- go back to the smart contract tab or window
- click on the
Write as Proxybutton - connect Metamask by clicking on the
Connect to Web3link - click on
14. unstake- paste the number you have copied in the previous step
- click the
Writebutton and confirm the transaction in Metamask
- once the transaction has been mined, open it up in the block explorer to verify the BNQ have been sent to your wallet
Link to video guide for BNQ withdrawals via Polygonscan:
Here you can find link of liquidated ALBT Troves during the hack event:
Data for BNQ airdrop_ troves, LP, BNQ - Feb 21, 2023.xlsx
34KB
Binary
Please double check accuracy and let as know if you see anything missing or being not accurate on the spreadsheet.
On the following spreadsheet link, please check If and how your Trove was affected by Bonq's redemption mechanism. If you find any data not accurate, please contact team as soon as possible.
Data for BNQ airdrop_ troves, LP, BNQ - Feb 21, 2023.xlsx
34KB
Binary
On the following spreadsheet link, please check size of your DAI/BEUR and/or USDC/BEUR LPs that were affected by the exploiter on February 1st, 2023.
Data for BNQ airdrop_ troves, LP, BNQ - Feb 21, 2023.xlsx
34KB
Binary
User should remove any liquidity from all pairs, either directly on Bonq DeFi Terminal or by visiting Arrakis vault.
These data will be included in the upcoming airdrop evaluation!
If you find any data not accurate, please contact the team as soon as possible.
Next, you can find a list of wallets affected by the BEUR losses, that have purchased BEUR on the open market with cash, and not minted it in troves. We will compensate for this with the BNQ airdrop. For the airdrop, we’ll assume a BEUR price of $1.10
BEUR losses after the Feb1 attack.xlsx
11KB
Binary
We’ll wait until Thursday, February 23rd - evening for any possible issues to be reported and resolved.
Friday morning, February 24th, European time we’ll send the BNQ airdrop on Polygon.
We will take all the Trove and LP tokens affected by the attack per wallet and multiply them by the price of each token on February 1st, before the attack. This will give us the $ value of the losses. We will then use the BNQ price of $0.0175 and calculate how many BNQ should be sent to cover the $ loss.
We’re assuming that because of the attack BNQ lost 50% of its utility, and before the attack, it was trading at about $0.035, so we took 50% of that price.
This will translate to around 57.14 BNQ per each $ of the loss.
Then, we will compensate all BNQ holders for the loss of utility (so the difference of BNQ @3.5c vs 1.75c). Again, for each $ lost we’ll be sending 57.14BNQ.
For example, Alice lost $100 due to liquidations, $100 due to redemptions, and $200 in LP tokens, so $400 in total. She should get 22,857.14 BNQ. Bob has 1k BNQ on Feb 1, before the attack, so he should get 1k BNQ airdrop.
If you know your token holdings before the attack, you’ll be able to follow the math and estimate your airdrop. You can contact us to confirm if your calculations and ours are the same.
We’ll also send a test transaction to all wallets, so we can see if the batch airdrop payments work properly, before we send the actual airdrop amount.
In case of any questions, you can contact Michal Bacia or Delia Sabau.
Michal Bacia, Chief Economist
Delia Sabau, CEO