Convex Finance Forced to Abandon, Redeploy Contract Due to Bug

Convex Finance has been made aware of a bug in its vlCVX rewards system, requiring the team to redeploy a new contract. No funds were lost, and “user deposits were not at risk,” Convex said.

Convex Finance Alerted to Bug

Convex Finance was forced to unlock vote-locked CVX from a contract today due to a non-critical bug. 

The vote-locked CVX contract has been redeployed upon the discovery of a bug in its reward system. All CVX locked in the contract containing the bug were unlocked, meaning users who had vote-locked their CVX tokens will have to withdraw them and re-lock them in the new contract, if desired.

Vote-locked CVX tokens represent locked Convex tokens that reward platform fees and bestow voting rights. 

The bug, though not dangerous to user funds, allowed for the possibility of “expired locks to relock directly to a new address, which, in turn, enabled them to claim more cvxCRV rewards than they had earned.” The contract could not simply be patched since Convex’s contracts “are immutable and non-upgradeable,” meaning a new contract had to be redeployed and the old one simply abandoned. 

Employees at Popcorn, a yield generator that simultaneously funds social impact organizations, alerted Convex of the existence of the bug, for which it will be paid a bounty reward coming from Convex’s treasury. 

Convex Finance is a protocol that helps users earn higher yields from Curve, an automated market maker that allows for yield generation and liquidity providing and has the most total value locked of any decentralized finance platform. Protocols compete for veCRV, a governance token giving voting rights on where Curve rewards are distributed, so that more Curve rewards can be directed to their own protocol, boosting yield and total value locked. This has been dubbed the Curve Wars. 

Convex allows users to earn Curve staking rewards while retaining liquidity via the issuance of cvxCRV tokens upon locking CRV. cvxCRV can be traded at only a minor discount while CRV remains locked, earning yield. This mechanism has allowed Convex to perform well in the Curve Wars, and its total value locked crossed $20 billion earlier this year, which at the time gave it the number two spot only behind Curve in terms of total value locked. It has since fallen to fourth. 

The CVX token has fallen 15% today as of press time.

Disclosure: At the time of writing, the author of this piece owned BTC, ETH, and several other cryptocurrencies.