Spool — What went wrong with Notional USDC/DAI strategies, clearing (doHardWork), and how we’re moving forward
This article is dedicated to everyone affected by the inability to deposit, withdraw, or otherwise use some of the vaults in Spool in its full functionality within the past several days.
What happened?
On January 23rd, 2024, the Notional team reported that they found a potential vulnerability that made them pause depositing to Notional V2 on Mainnet.
The inability to deposit to Notional meant that the Spool clearing mechanism (DoHardWork) for Notional strategies (USDC and DAI) could not be processed in time. The Spool DoHardWork batches deposits and withdrawal transactions for all vault strategies together.
Since clearing for one of the strategies was blocked, that meant two things:
- Vaults that use Notional USDC and DAI strategies on Spool were temporarily blocked since the allocation to strategies needs to happen according to the pre-defined allocation ratio.
- Funds flushed but not processed by clearing (DoHardWork) were temporarily stuck in the ‘on-the-way’ contracts.
Users could still withdraw from Notional pools with ‘Fast Withdrawal’, if they need to.
The notional team has assured us that a resolution will be found and deposits will be resumed soon.
On January 30th, the Notional team reported that the issue had been resolved: “We’ve pushed the fix, and Notional V2 on Mainnet is now fully operational again”.
The spool team has tried to deposit into the Notional USDC lend pool, but the transaction reverted, however, not with the same code as previously. This was caused by the fix that Notional had to make in response to the recent issue: minting nTokens will fail when the fixed rates are above a certain level.
There was no apparent upcoming fix for this since the Notional team had made it clear that their focus would shift to V3, while V2 would be either deprecated or force-migrated to V3.
In the end, on Thursday 1st February, the Spool team decided that the most reliable way to serve Spool users would be to remove Notional strategies from protocol and this way unblock user funds.
The plan to immediately unblock Vaults affected by the Notional strategy issue
The process includes two steps:
1. The Notional USDC and DAI strategies will be removed from the vaults.
This way, vaults (about a dozen affected) will become operational again.
Timeline: Prioritised to be finalized by the middle of this week
2. The funds from the vaults that use Notional strategies (only the part that is in the Notional strategy) will be extracted and distributed to each investor’s wallet back directly.
Timeline: We are aiming to execute this by the middle of next week (Wednesday 14th February 2024)
What is the likelihood that this will happen again?
The composability of DeFi assumes that there is a risk caused by underlying protocol dependencies. Spool’s near-term vision is to orchestrate users’ funds’ yield management connecting over 50 various strategies, therefore, we need to be prepared that some issues, that we can’t affect, will happen in the underlying protocols and strategies.
Playbook for future incidents and crisis response methodology
That’s why Spool DAO has developed an internal playbook to measure various incidents, internal guidelines to react to the incidents in an efficient manner as well as communication guidelines to inform our users of the current state of the incident and its resolution, according to the incident risk score.
Internal resolution and external communication guidelines are enacted according to this score matrix:
______________________
Spool is a permissionless DeFi platform that connects Capital Aggregators with DeFi Yield Generators. Funds are dynamically and efficiently allocated to ensure optimized yields, for custom strategies, managed by DAO-curated Risk Models.
Spool was established as a DAO, with a selection of founding contributors representing a diverse cross-section of the blockchain community.
Website | Telegram Ann | Twitter | Medium | Discord
