<\/p>\n
The Harmony bridge hack saga highlights crypto’s lack of recourse and the risks of composability. <\/p>\n
Depending on how you count, there have been roughly 20 hacks worth over $100M which have hit crypto.<\/p>\n
While the hacks attract attention and generate clicks in the short term, the financial mess they leave behind often fades from the news cycle before any resolution is reached.<\/p>\n
The $100M Harmony Bridge hack, which happened<\/a> just over 500 days ago in June 2022, is one example of an exploit that has faded from headlines, but whose story hasn\u2019t actually ended.<\/p>\n Users\u2019 efforts to recoup their assets on a Harmony deployment of Aave, a lending platform which holds over $5B worth of assets in total, tells a story of participants\u2019 in DeFi\u2019s resourcefulness, but also of the space\u2019s pitfalls and inefficiencies.<\/p>\n <\/a><\/p>\n A proposal to recoup roughly 20% of the assets locked in Aave on the Harmony blockchain is bringing a glimmer of hope to victims of the hack, but whether Aave and Harmony will back it is still undecided.<\/p>\n The amount users have lost isn\u2019t large \u2014 roughly $1.2M \u2014 but the saga provides a warning to crypto users as another bull run is showing signs<\/a> of returning that the further down the rabbit hole you go, the greater the risks.<\/p>\n Composability, what at one point was called \u201cmoney legos,\u201d means crypto protocols can easily plug into each other. It also means users should account for risks in not just the token they\u2019re holding in a specific platform, but also for risks of all the connections used for it to get there.<\/p>\n A representative from Aave Companies did not immediately respond to The Defiant\u2019s request for comment regarding the upcoming vote and whether AAVE voters bear some responsibility for the assets stuck on the Aave Harmony deployment.<\/p>\n Starting from the beginning \u2014 Harmony was one of the hot Layer 1 blockchains in June 2021. Its native ONE token had a market capitalization of nearly $800M, and it seemed like the market for smart contract platforms was big enough that every Layer 1 which launched would succeed.<\/p>\n Start for free<\/a><\/div>\n At that point, Li Jiang, COO of Harmony, first posted<\/a> on Aave forum, pushing for the lending platform to deploy on the blockchain he was building. After some debate and brigading from Harmony supporters, holders of the AAVE token voted<\/a> in December to deploy Aave on the blockchain.<\/p>\n The market was destined to peak at that time \u2014 it turned out that the total crypto market capitalization had already topped out at just over $3T in November. And Harmony\u2019s ONE token would post an absurd-sounding $4B market capitalization two months later in January 2022.<\/p>\n Aave would officially deploy<\/a> on Harmony in March. Over the next three months, users would deposit roughly $3M in assets, according to a post<\/a> made by BGD Labs, a company which supports Aave.<\/p>\n That\u2019s not a huge sum \u2014 Aave had over $5B in total value locked at the time.<\/p>\n Then the hack happened. The exploit was controversial in itself as Harmony took serious heat for what many deemed subpar security practices. <\/p>\n For Aave\u2019s deployment on Harmony, it meant that lenders of tokens that were native to the Harmony blockchain, primarily ONE and LINK, saw their assets had been indefinitely borrowed out as a result of the attack.<\/p>\n This was because the bridge hack meant that all assets which people bridged from Ethereum, the world\u2019s most used Layer 1, became unbacked. Aave however, used a price feed which didn\u2019t register that the assets on Aave weren\u2019t backed.<\/p>\n This meant that opportunists swooped in and deposited bridged and unbacked assets like USDT and USDC and borrowed ONE and LINK tokens which weren\u2019t directly affected by the bridge hack.<\/p>\n It\u2019s not known what the opportunists did with the ONE and LINK, but the intuitive action would be to sell the tokens \u2014 with the collateral worth less than the debt there\u2019s no reason to return the tokens to Aave\u2019s lenders.<\/p>\n It wasn\u2019t a huge amount of assets \u2014 opportunists quickly borrowed $398,000 of ONE tokens after the hack, with $1.2M worth of ONE borrowed in total, according to BGD Labs.<\/p>\n What followed was a strange and drawn out battle for accountability. <\/p>\n One user, a software engineer named R\u00e9mi, had been acquiring ONE tokens for two years leading up to the hack on Harmony. He told The Defiant he took time after work to develop trading strategies, take advantage of new product launches as well as Harmony\u2019s $300M<\/a> incentive program, in order to acquire around $200,000 of ONE tokens.<\/p>\n R\u00e9mi asked for The Defiant not to use his last name or employer to maintain his privacy.<\/p>\n It\u2019s been well over a year and the engineer still doesn\u2019t have his assets back, which to be fair, is the norm with hacks in crypto \u2014 people generally don\u2019t get their money back.<\/p>\n But the story for R\u00e9mi, and others who deposited on Aave\u2019s Harmony deployment, is a bit more complex than clicking a corrupted link and losing potentially years worth of income.<\/p>\n For one, the hack\u2019s effect on ONE lenders on Aave was a secondary one \u2014 R\u00e9mi\u2019s assets weren\u2019t bridged, so they didn\u2019t depeg. Immediately following the hack, R\u00e9mi thought he was safe. \u201cI just considered [the hack] as bad news for the price of the coin,\u201d he said. \u201cI have no idea it would impact me so much to have all my ONE coins stuck.\u201d<\/p>\n Instead, opportunists swooped in and borrowed all the available ONE and LINK tokens. Since there is close to nothing backing those assets, Aave was hit with bad debt, roughly $1.2M in total.<\/p>\n In a sense, the lesson is a simple one \u2014 risks are always present in DeFi. Brand name protocols like Aave, can still suffer attacks indirectly from less-secure bridges to other blockchains.<\/p>\n There are also other takeaways \u2014 just because a person uses a decentralized protocol, doesn\u2019t mean they have any say over its direction. In efforts to recoup their assets, users railed against their powerlessness in the face of Aave\u2019s governance.<\/p>\n \u201cImagine your bank refusing to help you with [a] complaint because you don\u2019t have enough money in the account,\u201d said one user in a year-long discussion<\/a> about the Harmony recovery on the Aave forum.<\/p>\n One key issue is that a minimum of 50 AAVE tokens, worth nearly $5,000, is needed to submit a vote, according to the Aave forum. \u201cAfter losing so much you don’t want to invest $5000, or $6,000 to buy AAVE just to organize a vote,\u201d R\u00e9mi said.<\/p>\n A community member did manage to submit a recovery proposal<\/a> in March, but it was short on details and Aave governance shot it down with over 99% of AAVE tokens voting against.<\/p>\n The Aave team ended up freezing<\/a> Harmony\u2019s reserves, so roughly $3M in assets couldn\u2019t be withdrawn, but that was more than three weeks after the hack.<\/p>\n R\u00e9mi thought this happened much too slowly. <\/p>\n \u201cBorrowing got frozen a few days after, which [gave] time for hackers to exploit the protocol,\u201d he said. \u201cLending itself got closed a month after.\u201d<\/p>\n The engineer added that some unsuspecting users deposited assets during that month because they saw a high interest rate on Aave because so much ONE had been borrowed.<\/p>\n Overall, the parties involved struggled to define who was responsible for what in the hack\u2019s wake.<\/p>\n Ernesto Boada, co-founder at BGD Labs, a key service provider to Aave, told The Defiant it was difficult to coordinate with the Harmony team. \u201cIt really felt after the hack that Harmony was not really involved,\u201d he said.<\/p>\n Other users\u2019 struggled with similar issues \u2014 one user asked simply \u201cwho is \u2018Harmony Team\u2019 on this forum,\u201d in a discussion<\/a> on the blockchain\u2019s forum. The user received no answer.<\/p>\n A document<\/a> on the Harmony team\u2019s website lists 20 team members, with Steven Tse, an alumnus of Google, Apple, and Microsoft, as in charge of \u201cproject vision.\u201d Tse lists himself<\/a> as Harmony\u2019s founder on LinkedIn.<\/p>\n The Defiant has reported<\/a> on struggles that validators, entities which support the Harmony network, have had with the Harmony team in the past.<\/p>\n To Boada, the issue of Aave\u2019s Harmony deployment is fundamentally the responsibility of the bridge. <\/p>\n \u201cAt the end of the day, the hack is on [Harmony\u2019s bridge],\u201d he said.<\/p>\n BGD made changes to Aave after the hack \u2014 the service provider helped implement<\/a> a system called \u201cproof of reserves,\u201d which aims to prevent the kind of mismatch between prices reported to Aave and the actual prices of a given asset.<\/p>\n Boada added that BGD has also started to analyze networks more thoroughly before endorsing Aave deployments there.<\/p>\n The BGD Labs co-founder said that he has been able to contact Recovery One, a team working with Harmony on recovery effort in the wake of the bridge hack, more easily than he could the Harmony team post-hack.<\/p>\n Matthew Barrett, from Recovery One, told The Defiant that he thought DeFi will emerge stronger from all the struggles to deal with the fallout of the Harmony bridge hack.<\/p>\n The story isn\u2019t done \u2014 last week someone from Recovery One posted a proposal<\/a> which would pay roughly ten cents on the dollar to users whose ONE tokens have been borrowed indefinitely. This would amount to about $50,000, at today\u2019s ONE prices. Aave, the decentralized organization, would be on the hook for another 10%.<\/p>\n Barrett said that BGD Labs had proposed a solution somewhat inline with Recovery One\u2019s a few months earlier. That a key service provider to Aave promoted a similar proposal makes the Recovery One team member think it\u2019s possible that AAVE voters will throw their weight behind the new solution.<\/p>\nProposal Re-Surfaces<\/h2>\n
Harmony Backstory<\/h2>\n
\n
Bridge Hack and Aave Exploit<\/h2>\n
Loading Up on ONE<\/h2>\n
Composability Risk<\/h2>\n
Lack of Say<\/h2>\n
Slow Reaction<\/h2>\n
Questions of Accountability<\/h2>\n
Post-hack Changes<\/h2>\n
10 Cents on the Dollar<\/h2>\n