Raft Recovery Plan

General
1

EDIT: We’ve published the revised recovery plan for all affected users.

Read More

Following the recently published post-mortem for the security incident that occurred on 10 November 2023, the below proposal outlines a compensation plan for the impacted users in the fairest and most equitable way.

3,963,192.62 DAI from the peg stability module (PSM) will be distributed to users affected by the incident based on their holdings and interactions with the protocol as of the snapshot time (14 November 2023 09:48:47 PM | Block: 18572928).

Eligibility Criteria

To be eligible for compensation, users must meet the following requirements:

1. Holdings Requirement: They must hold R (either idle, in RR, or LP tokens) as of the snapshot time.

2. Trading Activity Restriction: They have not traded any R after the exploit date.

3. Special Case for MEXC Users: Users holding R in MEXC must provide proof that they purchased these tokens before the exploit date.

Compensation Categories

Compensation (in DAI) has been calculated differently for three categories of affected users:

1. Liquidity Providers (LPs)

Methodology: Compensation will be based on the USD value of each LP position at the snapshot time.

The liquidity pools considered for the compensation plan include

  • R/sDAI (Balancer)
  • R/DAI (Balancer)
  • R/wstETH (Balancer)
  • R/wstETH (Maverick)
  • R/rETH (Maverick)
  • R/ETH (Maverick)
  • R/USDC (Uniswap V3)

2. RR Holders

Methodology: Compensation will be based directly on the amount of R held in RR (Ethereum mainnet and Base) at the snapshot time.

3. R Idle Holders

Methodology: Similar to RR holders, compensation will be based on the amount of idle R held at the snapshot date.

Check out the compensation distribution details among wallets in the spreadsheet below:

Further considerations and final steps

The current draft of the recovery plan is open for comments and feedback from the community until 23:59 UTC on Tuesday 21 November 2023.

WE KINDLY ASK EVERYONE TO PROVIDE FEEDBACK IN THIS GOVERNANCE FORUM.

After this feedback period, the plan will be finalized and implemented, with regular updates and further information on how to claim your compensation provided to the community.

1 Like
2

It’s a bit harsh. Everyone who held R in the pools during the time of hack deserves compensation. However, those who bought the amount of R after the hack shouldn’t receive any, leading to a total loss of the value they spent on speculation. That’s fair and how it should be.

You can calculate a user’s lost value in the hack by simply excluding the amount that any buyer has received from sources other than these pools after the hack.

1 Like
3

I don’t think excluding those who sold R is fair.

I personally sold for less than 60% (which is the current compensation), by selling, the price of $R was reduced, making the hacker less profit.

Just reduce what people sold from the 60% comp, it’s the fairest.

For example, a person sold 10k R for 3k USDC, then is only compensated with $3,000 DAI.

There are 312 wallets that were sold, it is not impossible to review this, it would take a little longer, but it’s the fairest.

1 Like
4

I tried posting in discord but was instantly issued a ban. I’ll preface this message with the context that me and several other users I know have consulted legal council, and I was merely forwarding previous communications on the advice of council.

Like others, I feel that this recovery plan dismisses legitimate claims of loss by certain segments of users and also places an unreasonable burden on users to “prove” losses in order to be entitled to a share of the recovery funds.

For instance, consider who was holding R stablecoins at the time of the exploit. When an exploit happens, it is extremely common for users to liquidate affected assets. But if I am reading this plan correctly, these users will be excluded from the recovery plan. .There was no official communication from the team for 19 hours following the hack, how would these users have known not to sell their R which was plummeting in value? Is that fair or just?

I’m wondering if the reason that these users have been excluded is because it would then also entitle buyers of R during the 19 hour period of ambiguity to compensation i.e. if R exiters were compensated, its only fair to also compensate their exit liquidity. But rather than fairly classifying these buyers as willing market participants, playing by the rules of the smart contracts (PSM backs the stablecoin), the team seems to have chosen to dismiss these users as greedy speculators.

Picking and choosing which users to compensate, especially with a short pro forma comment period (team members indicating that payments will happen next week) sets a bad precedent in DeFi and I would strongly encourage the team to reconsider this proposal and token holders reject this proposal.

1 Like
5

Seems like LPs need to be compensated more and not based on a snapshot many days after the hack.

Snapshot should be from block before the exploiter sold funds into the LP. Then it should exclude anyone who bought R for speculation purposes (ie any wallet that does not have debt). If the wallet also has debt, then it should be excluded as well like it has been from the current version. They haven’t lost any money and are able to repay their debt at a profit.

Then the rest should be distributed to LPs according to their balances pre-hack.

In addition to the DAI distributed from the PSM the team also should include some kind of token allocation or other compensation for these holders. Right now it is .61 DAI for each R, where is the rest going to come from? The project has unspent token allocation and raised a sizable amount that can be used to compensate R holders as well.

6

@R-LP I agree, LPs should be compensated for the values they have lost in this hack. If someone has already sold their R and got the same value as the compensation, they should not receive any further, or only the difference in the value they’ve lost. Additionally, anyone who bought R after the hack should not be compensated for the amount of R they spent on it, losing that entire value on the speculation. This approach ensures fairness for everyone.

7

This makes sense & agree with others who have shared similar sentiment here. The communication was not clear enough – some sold for less than the compensation plan amount, others did not sell all their positions. This needs to be factored in and fixed to a point, or else there’s a situation where those meaningfully get left out of the compensation equation, and thus are unlikely to be trusting of the future version of R products.

1 Like
8

Any buying after the hack shouldn’t be compensated. The liquidity was completely drained from all pools. Anyone who bought was either 1) buying to repay debt cheaply in which case they will have made money.

Imagine the case of someone who opened a loan, sold R to DAI and then has bought back after the hack. they would have made a lot of money on this at the expense of LPs who are now holding the worthless R.

Anyone without debt who was buying R would have just been speculating, once again at the expense of LPs.

These considerations don’t matter much because we should just take the snapshot based on the block pre exploit and then exclude users that had debt at the time.

The only people who have lost money here are pre-hack LPs or R holders who did not have debt.

1 Like
9

Why does buying R come at the expense of LPs? Their LPs are worth more due to this? Also once again, assuming PSM will back the stablecoin would never hold up as “speculation” in a court of law

10

Why was the team deliberately quiet for nearly an entire day? I would also appreciate some more clarity on this. It seems reckless to not communicate for this long, and then expect users to know that the rug will be pulled out from under them with rule changes after the fact. This is as bad as what the hacker did

1 Like
11

why people who staked R/RAFT are not receiving anything? Is that a fair? We locked thousands of dollars in your protocol and now you are just skipping us. Looks like the team themselves made a rug

12

There will be a separate proposal for that.

13

How do you expect people to evaluate this holistically if important parts are pushed off for separate proposals? How are we to believe that the Raft team have really given this serious consideration?

14

As other’s have pointed out above I don’t feel this is fair to LPs who took risk to supply liquidty to R pools, and who therby supported and helped to grow your project.

After the hack we took a loss on the drop in value of R and it’s only natural in a moment like that to minimize losses by selling R.

By taking the snapshot hours after the hack you are penalizing users who react quickly and reward those who do not react. In the hours after the hack I asked on discord about recovery for those who sold R at a huge discount for exactly this reason and team would not comment.

The fair thing to do would be to take the difference between what we got from selling R (around 25c on the dollar) and the recovery amout of 60%.

It may be a bit more effort to crunch the numbers on that but thats not an excuse to just leave us LP hanging and instead reward the speculators who bought R at a discount and took no risk at all to LP in the pool for months.

I really dont understand what the rational is on this. It is not fair to the LPs, who are the ones most affected by this hack.

I really hope you will not dissapoint the community by going through with this…

15

With this proposal you are basically saying that a user who bougth R 1hour after the hack as a speculation on repeg is entitled to more then LPs who have provided liquidty for months and but sold R after the hack to cut their losses in an evoirement of chaos and no comms from team. This makes no sense to me.

Aslo the block and time of the snapshot seems totally arbitrary, why exactly that one? What if someone sold their R one block after that, they get full recovery and some funds out from sale of R? But if someone sold 1 block before snapshot they get no recovery?

It would make more sense to take the block before the hack, no ambiguity on that

1 Like
16

This is 100% bullshit, users who sold less than 10% of their idle holdings are getting rugged. There was no mention of the compensation being withheld from users that tried to get something back out of nothing.

I understand that speculators should not have bought but what about the users that sold why are they being punished and being omitted this is obscene.

17

This proposal seems sensible.

Does it make sure that wallet with debt at snapshot time aren’t getting compensated? Like R-LP mentioned people with debt can receive their collateral and should not receive extra compensation.

I don’t understand why people who sold their R should be compensated. You took the decision to exchange R for their current value, selling any potential future value. You shouldn’t expect the free optionality of canceling this trade if it becomes bad. Offering this free option to sellers who dumped their token on LP seems unfair.
In a bankruptcy if you sell your claim, you don’t get to cancel it if it happens that the recovery is higher than what you sold for.

Taking the snapshot as of 14th Of November seems a good idea, because it accounts for the current state of loss of each wallet, assuming there has been little change between the snapshot and the announcement of the recovery plan.

Taking the snapshot at the time of the incident is clearly unfair as some wallet have done much better than other depending on their activity between the incident and now. After compensation It would even lead to some wallet making an overall profit from the situation.

18

I propose the timing of the snapshot to be at the block of the exploit rather than an arbitrary time after the hack to rule out the following users:

  • People that had R debt but could have transferred their R to another address, making the address that received R eligible for compensation when net R exposure after debt is low
  • People that bought R after the hack out of speculation and the proceeds went mostly to the exploiter

It does not make any sense to make addresses with R trading activity ineligible for compensation as some of the addresses had genuine R exposure. The team should screen the addresses based on the size of net R exposure up to the point of this snapshot. Scenarios below:

  • If someone had 100k R exposure before the exploit, then sold 50k R after the exploit, they should still be eligible for compensation for AT LEAST the 50k R they held to now, there isn’t any good reason to exclude them altogether
  • If someone had 100k R exposure before the exploit, then bought 50k R after the exploit, they should still be eligible for compensation for the 100k R exposure they had before buying R after the exploit

The reasons are:

  • There was no communication from the team immediately after the exploit as to what’s the appropriate action was, it was reasonable to reduce R exposure
  • People who had R exposure before the exposure bought R at $1 and had the right to sell R any time and shouldn’t be punished for selling R, especially when selling R into the pool reduced the gain of the exploiter
  • People who had R exposure before the exploit, but also bought R after the exploit shouldn’t be punished for their entire R exposure, as they also suffered loss buying R at close to $1 before the exploit, the R bought after the exploit should not be eligible for any compensation but their R exposure before the exploit should be eligible for compensation
  • People who bought R after the exploit out of speculation should not be eligible for compensation as their proceeds mostly went to the exploiter and they decided to take the risk of buying R after being aware of the exploit

It shouldn’t take too long to do such screening if based on materiality sorted by net R exposure, addresses with insignificant net R exposure at the snapshot can be skipped as it may not worth the time.

Whether to compensate people who sold after the exploit the difference between the compensation and the amount the received should be a separate option in the snapshot as it is more ambiguous. It is more important that people with actual R exposure isn’t excluded from the compensation first just because they had some R trading activity.

Another possibility is giving addresses who sold R after the exploit a couple of days to apply for an address review for potential compensation for the difference between their proceeds and compensation amount, addresses that suffered a loss would be following this closely so a short review window may be sufficient. After the window closes, the team can publish a more detailed compensation outcome with all parties considered.

4 Likes
19

I 100% agree with this.

20

Thank you all for your suggestions. The plan is now being revised based on community feedback.