An ongoing feud between Alpha Homora and Iron Bank has led to Iron Bank changing its code to prevent lenders from withdrawing their liquidity. Iron Bank has indefinitely paused Alpha Homora’s lending accounts, effectively holding Alpha Homora’s assets hostage until a longstanding debt between the two protocols has been repaid.
This incident has led to much discussion surrounding the unethical misappropriation of users’ funds and the dangerous precedent it sets for the DeFi community.
This article will cover the Alpha Homora exploit in 2021 that led to over $30 million in debt owed to Iron Bank. Afterward, we’ll unpack Iron Bank’s controversial decision to alter the code and the ongoing state of affairs from the position of both projects.
The Alpha Homora Exploit
The history of this incident starts in February 2021. In one of the largest exploits in DeFi history, an attacker successfully drained over $37 million from Alpha Homoroa by leveraging Iron Bank’s protocol-to-protocol lending platform.
The attacker used Alpha Homora to borrow and lend repeatedly with Iron Bank, which allows for leveraged lending. They leveraged two separate flash loans to acquire sUSD to lend to Iron Bank, which allowed them to continue borrowing and lending them, receiving cySUSD in return.
In the end, the hacker accumulated an ‘incredible amount’ of cySUSD, which allowed them to borrow anything from Iron Bank.
Iron Bank Debt
At the time of the exploit, Alpha Homora owed Iron bank the following:
- 11,245 ETH
- 4,263,139 DAI
- 4,032,014 USDC
- 5,647,242 USDT
For a total debt of $32,429,175.
Terms and Conditions
The two protocols agreed to terms to see the debt paid off. At the time, both parties agreed to
- Have the bad debt paid down by using 20% of Alpha Homoroa’s protocol fees to pay off the debt
- Have 50 million ALPHA tokens locked to be used as collateral
Alpha Homora has been slowly chipping away at the debt through its protocol fees monthly since the hack, as per the agreement. According to a post from Iron Bank, as of March 2nd, 2023, the balance of Alpha Homoroas debt was $31,947,429.
Over the past two years, Alpha Homora has paid off $481,746 of its debt. At the current repayment rate, it will take over 540 years to repay the debt.
Worse, the collateral backing the debt has depreciated alongside the overall crypto market. As a result, the debt has become undercollateralized.
Iron Bank has raised concerns twice regarding the collateral, and according to Alpha Homora, the two protocols have reached a mutual agreement on solutions to the problem.
The first solution that was implemented was to add more collateral. The second solution that was to rebalance the debt.
Iron Bank Alters Code
On March 1st, 2023, Iron Bank paused Alpha Homora’s protocol lending accounts. Specifically, Iron Bank changed the smart contract config so lenders cannot withdraw their liquidity.
The Alpha Homora Perspective
According to a letter from Alpha Homora, Iron Bank raised concerns for a third time regarding the undercollaterized debt on February 14, 2023. Alpha Homora agreed to develop a new solution and requested time to figure out a plan.
On March 1st, 2023, the team allegedly messaged Iron Bank with an answer at 5 PM UTC+7, hoping to set up a time to discuss the proposed solution.
Three hours later, Iron Bank unilaterally and without notice changed the code, preventing lenders from withdrawing their liquidity.
According to Alpha Homora, they had honored the terms of the previous agreement. They highlighted that they had diverted 20% of protocol fees to pay off the debt. Due to the ongoing crypto bear market, on-chain and DeFi usage have suffered, leading to lower protocol fees.
Iron Bank allegedly ignored Alpha Homora’s attempts to provide a solution, changing the code and igniting controversy.
According to a second open letter between the two protocols, Alpha Homora has been continually contacting Iron Bank to discuss a solution over a call. Iron Bank wishes to see a solution in writing, while Alpha Homora wishes to discuss the proposed solution before committing to any agreement.
They highlight that the original agreement between the two parties has been breached. The previous terms stated that if the collateral was not topped up within three days of Iron Bank’s request, Iron Bank reserves the right to liquidate a portion of the escrowed ALPHA to pay off the debt.
However, Iron Bank chose to freeze users’ funds instead.
The Iron Bank Perspective
On March 3rd, 2023, Iron Bank released a statement regarding the exploited debt. On February 14th, Iron Bank requested additional collateral to cover the deficit, which Alpha Homora had three days to provide, per the agreement.
Iron Bank claims that the request was ignored for two weeks. In light of the declining liquidity of ALPHA tokens, the decision was made to pause Alpha Homora’s lending accounts to “ensure Keep3r, FixedForex, Yearn, Curve, and direct IB depositors are protected”.
Iron Bank issued Alpha Homora an ultimatum: repay the total exploit debt by March 5th, or Iron Bank will offset the debt with Homora’s user funds.
Upon repaying the debt owed, Iron Bank will unpause the Alpha Homora accounts and return the ALPHA token collateral.
Iron Bank’s current stance is that it seeks a written solution from the Alpha Homora team in the name of transparency. They claim “written responses are to protect all parties involved and provide full transparency.”
The Current State of Affairs
In the third open letter from Alpha Homora to Iron Bank, posted on the 5th of March, Alpha Homora has proposed a package of solutions to discuss a final solution with Iron Bank.
- Iron Bank returns customers’ funds that are not on Ethereum.
- Out of the ~$41M on Ethereum, Iron Bank is to transfer ~$11M to users. ~$11M represents the amount of users’ deposits net bad debt and not including interest accrued.
- For the remaining ~$30M, we will share details with the community on handling it within one week after Iron Bank agrees to the above solutions.
Alpha Homora has suggested that they will explore legal actions as long as user funds are locked.
Meanwhile, Iron Bank has stated that a proposed solution has not been adequately provided to them and continues to insist on a written response.
The Iron Bank maintains its pause on withdrawals for the affected lending accounts and has publicly stated, “Alpha Homora needs to take ownership of for the cost of their own exploit.”
Update: 03/08
On 08/03, Iron Bank unpaused Alpha Homora’s accounts on Optimism, Avalanche, and Fantom without any communication to Alpha Homora or its users. Currently, Alpha Homora V2 users can withdraw their funds on these chains.
Closing Thoughts
This messy disagreement between two protocols should have crypto users on the edge of their seats and wary of the dangerous precedent this may set for the DeFi community.
While Alpha Homora does owe Iron Bank an excessive amount of money, the unethical steps taken by Iron Bank have involved users in a protocol-to-protocol issue. Alpha Homora users are not responsible for the debt of their platform.
Iron Bank’s centralized control and unwillingness to communicate has led to questions surrounding code sovereignty’s ethical and legal implications and introduces a new concern for DeFi users across the ecosystem.
UPDATE
