ID:
fei-procotol-1146
100 pts
Platform:
Type:
Category:
Method:
Data Sources:
Ethereum
Protocol
Stablecoins
Rewards - Bug Bounties
Extended Method:
The issue is that anyone can call allocate(), which takes the protocol-controlled value (ETH controlled by the protocol, PCV) and puts it into the Uniswap pool at the prevailing market rate (and not the ETH/USD oracle price, as designed).
Days in Operation:
646
(1.77 Years)
100 pts each
Fei Protocol is a decentralized, algorithmic stablecoin that maintains the price of Fei at the peg through a variety of methods. One method is through Protocol Controlled Value (PCV). The idea is that the protocol itself controls a substantial amount of the liquidity provider tokens (LP tokens) in the Uniswap V2 pool for the ETH/FEI pair (an LP token represents a pro rata share of each pool of tokens that are deposited).
Whitehat Alexander Schlindwein, known for receiving the largest ever bug bounty payout after finding a critical bug in ArmorFi, discovered a critical vulnerability in Fei Protocol. Concurrently and independently, Fei Protocol’s expert security team, led by Joey Santoro, also discovered this bug and immediately paused the contract. If this vulnerability had been exploited, it could have drained the protocol of 60,000 ETH via a flash loan attack (limited by the ~1m in ETH available across the ecosystem for flash loans). The vulnerability was not exploited. No funds were lost.
Fei Protocol is awarding Alexander Schlindwein an $800,000 bounty, paid in TRIBE. This award is in recognition of Alexander’s contributions to the fix of this vulnerability and as a demonstration of Fei Protocol’s commitment to whitehat hacking and to the broader Ethereum ecosystem.
DISCLAIMER: While web3rekt has used the best efforts in aggregating and maintaining this database, this web site makes no representations or warranties with respect to the accuracy or completeness of its information and data herein, and specifically disclaim any implied warranties of merchantability or fitness for any particular purpose.
Under no circumstances, shall web3rekt be liable for any loss of profit or funds, any regulatory or governmental penalties, any legal costs, or any other commercial and non-commercial damages, including but not limited to special, incidental, consequential, or other damages from any or all usage of the data and information derived from this database.