link.png

ID:

fei-procotol-1149

Date:

Status:

Incident Count:

April 6, 2021

Near-Miss

2

info.png
target.png
REKT

Contributor:

chain.png

web3rekt.com

KYC By:

KYC:

None

info.png

Audit By:

Audits:

OpenZeppelin, Consensys Diligence

Loss Amount:

-

info.png

Recovered:

-

Rewards:

300,000

Currency:

USD

info.png

Key Indicators

Platform:

Type:

Category:

Method:

Data Sources:

Ethereum

Protocol

Stablecoins

Rewards - Bug Bounties

Extended Method:

Manipulation of peg and reward

info.png

Days in Operation:

646

(1.77 Years)

chain.png
chain.png
chain.png
chain.png
datasource.png

Fei Protocol is a decentralized, algorithmic stablecoin that maintains the price of Fei at the peg through a variety of methods. One method is through Protocol Controlled Value (PCV). The idea is that the protocol itself controls a substantial amount of the liquidity provider tokens (LP tokens) in the Uniswap V2 pool for the ETH/FEI pair (an LP token represents a pro rata share of each pool of tokens that are deposited).

0xRevert submitted a critical vulnerability as part of Fei Protocol’s bug bounty on Immunefi, which if exploited by a malicious user could have repeatedly drained ~1410 ETH from the WETH/FEI pool on Uniswap. Following the bug submission, Fei introduced a temporary mitigation that pauses minting of rewards until a more permanent fix can be implemented.

In this case, assuming a situation where the FEI price is below the peg, a malicious user could purchase FEI, pushing the price not just back to the 1:1 peg, but above the peg, receiving some amount of FEI as a buy reward in the process.

For this find, Fei Protocol is awarding 0xRevert a $300,000 bug bounty at this time.

info.png

DISCLAIMER: While web3rekt has used the best efforts in aggregating and maintaining this database, this web site makes no representations or warranties with respect to the accuracy or completeness of its information and data herein, and specifically disclaim any implied warranties of merchantability or fitness for any particular purpose. 

Under no circumstances, shall web3rekt be liable for any loss of profit or funds, any regulatory or governmental penalties, any legal costs, or any other commercial and non-commercial damages, including but not limited to special, incidental, consequential, or other damages from any or all usage of the data and information derived from this database.