Bug in Alchemix’s New ETH Vault Has Left a $6.4M Shortfall

A bug was discovered in the Alchemix Finance alETH contract on Wednesday morning, leaving the project undercollateralized by 2,688 ETH, or roughly $6.4M, as users were able to withdraw these funds without repaying their loans first.

Alchemix Finance recently launched alETH, a synthetic yield derivative that lets DeFi users borrow 1 alETH for every 4 ETH pledged as collateral. The ETH collateral is deployed into Yearn vaults, and the resulting yield is used to automatically pay off the outstanding alETH debt over time.

But today some users reported being able to withdraw their ETH collateral despite having outstanding debt as can be seen in this series of transactions below. The Alchemix team has since released an Incident Report. Users are requested to return excess ETH withdrawn in exchange for future rewards, while the team plans to make up the shortfall through an increase in fees and contributions from the project’s Treasury.

The Alchemix team has already paused further borrowing of alETH as they investigate the issue, according to the project’s Discord . The team has announced that user funds are safe. As there was a borrowing cap of 2,000 alETH in place, losses were limited.

Alchemix’s ALCX token is down over 20% today to $470, a level not seen since the project’s launch. The slide steepened after the bug was flagged on the project’s Discord.

Meanwhile, the community seems to be taking it in their stride, with many looking to ‘buy the dip’ as confidence in the project remains high.

[UPDATED 6/15 @ 10PM EST TO INCLUDE SHORTFALL AMOUNT AND INCIDENT REPORT]