Greetings community,
Since we began troubleshooting the wBTC vault we discovered data corruption in the keymap storing of user vault position data triggering the contract error handling to not allow interactions with the vault (neither users nor liquidations).This was triggered by the following sequence:
- Multiple open positions
- A redemption performed against the wBTC vault
- An increase in the maximum allowed LTV
BTC is the only vault that is impacted by this precise sequence. Due to the keymap storage getting corrupted, there is no way to reliably restore access & the state of the current vault. Having detected the reality of the situation, the ShadeDAO pivoted to focusing on three things:
- Recovery of funds
- Reclamation of funds (+$40k Remediation Bonus)
- Sustainably fixing the keymap data corruption triggered by a redemption against a vault + LTV increase combo (this is why ETH + OSMO + ATOM vaults were unaffected)
To reiterate from earlier: all vaults other than the wBTC vault are operating normally; no users in the wBTC vault have been liquidated in the last 12 days as liquidations are not possible during this bug. An astute observer would ask why Max LTV was raised on the BTC vault if liquidations were not possible. This is because said precaution was taken prior to our understanding of the keymapping issue.
Recovery Of Funds
As of today, a redemption was performed by the ShadeDAO (turning in SILK to redeem BTC in the vault) to recover BTC from the vault. There is a total of 203,461.75 SILK debt in the wBTC vault that will be paid back and burned to ensure that no bad debt enters the system. The ShadeDAO has the necessary SILK funds to fully repay this debt in whole. However, instead of a full down payment the debt will be slowly paid off using the debt returned by users who were in the BTC vault.
The BTC was safely recovered to the following address: secret1dmya04qnutunactlc2mmlnjqnsm5rp7le8uks3
Public query of the funds:
secretcli q compute query secret1guyayjwg5f84daaxl7w84skd8naxvq8vz9upqx â{âbalanceâ : {âaddressâ : âsecret1dmya04qnutunactlc2mmlnjqnsm5rp7le8uks3â, âkeyâ : âRECOVERED_BTCâ}}â
To protect the privacy of users, an additional ShadeDAO address will be used with a separate (private) viewing key to protect the destination & amount of BTC sent back to user addresses.
This address is:
secret1xfk7ykptw7nlnwc4r66d84rgc3cqpd7hynczgq
Such that the flow of funds will be uks3 -(public)â> czgq --(private)â> impacted users.
Reclamation of wBTC collateral by Users:
There were 40 depositors in the wBTC vault at the time of contract lockup. The following process should be followed by these affected individuals in order to verify current user position: before starting this process, ensure that you have a Query Permit created for your loan. If you can view your debt and collateral deposits in the wBTC vault, you already have a Query Permit created. If you donât see your debt and balance, click âCreate Permitâ on the wBTC vault interface ( Shade App )
- Go to the Utilities tab on the Shade App (Shade App) and click âPermit Managementâ at the top of the page. Then click âCopyâ to copy your query permit to your clipboard.
- Next, click on the Support Widget at the bottom right of the Shade app. Then, search âBugâ and click the button to âReport a Bugâ
- Now, users will need to fill out this Support Report. Input the following:
Priority: Highest
Impact: Moderate/Limited
Summarize the problem: âwBTC vault positionâ
Description: Paste the contents of the Query Permit into the Description field
Contact Email: [Input email to which we can reply with a position verification notification]
Within 24 hrs, our team will send a reply email from jira@securesecrets.atlassian.net with a verification notice for your wBTC position (including current debt and collateral deposit and tx memo for next steps), and provide next steps for reclamation (same as what follows):
-
Users will need to send the amount for their current SILK debt in the wBTC vault to the following address: secret1xfk7ykptw7nlnwc4r66d84rgc3cqpd7hynczgq using the Send tab on the Shade app ( Shade App ). When users send their SILK debt to secret1xfk7ykptw7nlnwc4r66d84rgc3cqpd7hynczgq, INCLUDE THE UNIQUE MEMO RECEIVED IN THE SUPPORT EMAIL IN THE âMEMOâ FIELD ON THE SHADE APP UI.
-
Once a user sends their SILK debt to the following address, the user should send a reply email notifying that their SILK debt has been repaid, using their provided email to the support widget.
-
Within 24 hrs, our team will send a reply email with a verification notice that the user has received the wBTC deposit from their position in their wallet address as well as SHD that amounts to 10% of the users wBTC collateral deposits at the time of redemption as a token of our gratitude for your patience & our desire to provide the best possible customer experience.
Fixing The Bug
The above test case recreates the bug - the team is narrowing in a wholistic fix over the course of the coming weeks to be able to redeploy the BTC vault such that the recreation of said steps will not corrupt data stores in the future. We of course will be taking our time to ensure that the fix is 100% thoroughly tested.
We appreciate your patience with us as we continue to iterate & improve Shade Protocol. Every bug experienced is one step closer to being a perfectly consistent & highly trusted experience.
Onward and Upward,
Shade Contributors
