Chounky

Being real

[Schmalzi 🐺 @Schmalzi]

Someone emptied Tectonic's vault this morning. About $120 million borrowed against collateral genuinely worth a few hundred thousand.

It took eleven minutes.

Two hours later, Cronos stopped producing blocks. Here's what happened, in plain English.

Tectonic is a pawnbroker. You leave something valuable with it some Bitcoin, say and it lends you stablecoins against it. Don't repay, and it keeps your deposit. The cash it lends out is other people's savings, parked there to earn interest. TONIC is Tectonic's own token, and it's nearly worthless per coin.

Before today, 3.9 million TONIC was worth about 5p. Tectonic accepts it as collateral anyway. And to work out what your deposit is worth, Tectonic checks the price on VVS at that moment.

It trusts the price tag on the market stall. So picture a stall selling pebbles for a penny each. The pawnbroker next door lends money against pebbles, and glances at the stall to value them. A thief walks up and buys nearly every pebble on the stall in one go. With hardly any left, the price tag jumps from a penny to forty pence.

He then wheels a barrow of pebbles into the pawnbroker. The pawnbroker looks over at the stall, sees "forty pence each," values the barrow at millions, and hands over everything in the vault. The thief leaves and never comes back for the pebbles. The price drifts back to a penny. The pawnbroker is left holding a pile of gravel and an empty safe. That is exactly what happened.

tectonic:native was the pebbles, and the TONIC/USDC pool moved about 40×. How the morning went, UK time:

13:38:56 - The setup. The attacker deploys a contract and, in the same transaction, buys roughly 16 trillion TONIC out of three pools using about $200k of USDC and $400k of CRO. The pool price jumps ~40×. The same contract deposits that TONIC into Tectonic and adds 5 million USDC of real money, so the position looks like an ordinary large customer.

13:41 -13:45 - Two dry runs. Buy more TONIC, deposit it, borrow 2 million and then 1.3 million USDC. Both clear. Nothing stops it.

13:49:39 - The drain. One transaction borrows everything Tectonic has: the USDC, the USDT, the Bitcoin, the Ether, the CRO. It goes to two collection wallets.

13:50–15:15 - The scramble. Copycat bots spot the still-inflated price and scrape the last ~$2 million. Depositors race to withdraw whatever's left. Arbitrageurs drag TONIC back down. CRO and stablecoin prices swing around as roughly $60 million gets pushed through the pools.

15:32:47 — Lights out. Cronos produces its last block. Every public node stops at the same height, which isn't a crash �� that's validators halting the chain deliberately. The official RPC had already gone dark before that.

So how much was actually stolen?

Around $120 million walked out. The attacker put in roughly $5.6 million of his own to make it work - the USDC camouflage plus the CRO and USDC spent moving the price - and that's gone too. Call it about $115 million net, plus the ~$2 million the copycats took. Two things worth taking from this. First: nothing here was "hacked." No key was stolen, no lock was picked. Tectonic did exactly what it was built to do - it read a price off a thin pool and believed it. If your protocol reads spot price directly from a market someone can move, that price is for sale. Anyone with enough capital to shift the pool can tell your contract whatever they like. Spot price is not an oracle, and it hasn't been for years. Second: a chain that can be switched off by its validators is a different animal from one that can't.

That's a design choice rather than a flaw, and in a moment like this it's arguably the right call. But it's worth knowing which kind of ground you're standing on before you need to find out.

How much was stolen?

[Kokila Annamalai @Kokilaparvathi]

THREAD: In Singapore, families get only 7 days' notice before a loved one on death row is executed by the state. This is a small glimpse at the horror and hope they are consumed by as the clock ticks down to senseless state murder of their beloved.

[Chounky @chounky]

So I have always look like a potato https://t.co/rhoCvdyVMH

[🍍 __ 🙀 @sharanvkaur]

hi let's do a thread about trees and and singapore.

i like trees. i live in singapore. i'm not a botanist but i do have a gazillion photos of trees in my phone gallery so... bonafides ☑️

[Crypto.com @cryptocom]

This Father’s Day, get you and your dad matching #CROFam kits!

🔁 Just RT this post, and we’ll randomly choose 10 winners.

Terms and conditions apply: https://t.co/p7qD2FWg5v

[Chounky @chounky]

@angabridged Tbf, he has a point. Is our people over-reacting? There are more serious issues to be angry about, but personally won't be upset if my minister posing a scarecrow wearing a cheongsam.

[Yung Pueblo @YungPueblo]

People don’t see with their eyes, they see with their emotions.

[Chounky @chounky]

Orwell's ideas remain relevant 75 years after 'Animal Farm' was published https://t.co/RzWvOCZe6m via @ConversationUS

[Kirsten Han @kixes]

As a layperson, trying to follow #Singapore’s #Covid19 messaging since early 2020 has become incredibly confusing and just so damn exhausting.

This is a Covid fatigue thread/rant.

[Medium @Medium]

"Children with parents who earn near or above $112,000 are born winners, which makes it morally discomfiting when they (as adults) attribute their success to sheer gumption and grit." —@IWorryAboutYou

https://t.co/qvCvN0C1Y4

[Anndy Lian @anndylian]

@zhusu Based on what I know DBS is into the blockchain technology; trading & clearing etc. I know they have plans for crypto assets but I guess this soft launch is too early. BTW that URL & FAQ have been taken down from their corp site.

https://t.co/esZlkIz3si

https://t.co/rUJNkBEKHl

[The Stoic Emperor @TheStoicEmperor]

Charm may attract friends, but it is character that keeps them.

[Katherine Wu | katherine.eth @katherinewu]

Dear Twitter friends:

What are some of the best (if there even is such a thing) ice breaker questions/activities you’ve done? 🙏🏻

[Crypto.com @cryptocom]

Presenting https://t.co/vCNztABJoG Halving Special, with 50% off on $BTC on 12 May on https://t.co/vCNztABJoG Exchange-$1M allocation- No CRO staking required🔥Sign up now! https://t.co/bq8A5wmHlw
We're also giving away $100K in #BTC. Follow & RT for a chance to receive $250.

[Matt O'Brien @matt_obrien]

just a reminder that if your fellow self quarantining neighbors are being too loud you might be able to connect to their Bluetooth speaker

[Chounky @chounky]

Why Bing Isn't a Failure (& the Future of the Internet) https://t.co/BPYqTYEDrk via @YouTube

[Chounky @chounky]

Oh hell ya! https://t.co/acmopFOqAe