Post-mortem for Capsule bug

Photo by Sebastian Pociecha on Unsplash

Yesterday, we officially reached max supply. It’s been quite a journey and we’re truly appreciative of everyone who has supported us along the way.

We were monitoring the progress towards max supply and that’s how we discovered a bug with our MasterChef right after we hit max supply. This only affects Timeleaps and Capsules, and we posted an announcement right after to inform the community: https://t.me/timeleapfinance/32003.

As mentioned in the announcement, our Paladin audit didn’t catch the bug but our buyback-and-make model is a new innovation in this space after all.

Later on, as we were working on the fix and running our tests, we found another issue that was isolated to Capsules only (all other products are unaffected) that was likewise, only triggered after hitting max supply. What happened was that people could withdraw more than they should, from the specific Capsules that they’re staked in.

Thankfully, us devs had staked in a few of the Capsules and managed to secure the funds for USDC, USDT and WETH. We found two other community members who were staked in the WBTC, LINK and DAI Capsules, and have managed to secure those funds too.

Huge thank you to Ahmed and Sanju P for helping out with this. In total, we have secured around ~USD 74,893, the full sum across the USDC, USDT, WETH, WBTC, LINK and DAI Capsules.

All funds secured were previously held in one of our wallets. However, to give everyone a peace of mind, we have since transferred them to a newly deployed treasury contract with a 3 day Timelock. You may view it here:

Funds will be held in this treasury while we sort out who deposited how much in the respective Capsules from 7 Oct 2021, 3:15 PM UTC onwards (which is when upgraded Capsules were launched). Thereafter, we’ll transact the funds back to those wallet addresses.

There is a lot of data cleaning so we may take 1 to 2 weeks to complete all the transactions. But the funds transferred will be based on the amounts a wallet had deposited into a Capsule. They will also be in the same currency that was staked e.g. if you staked USDC, you’ll get USDC back. We will work as fast as possible to complete this.

Update (28 Oct):

Right after publishing this article, we decided to prioritize transfer of funds back to the wallets staked in USDC, USDT, WETH, WBTC, LINK and DAI Capsules.

We’d originally thought it would take 1–2 weeks, but we’ve made good progress and managed to clean the data within the same day. Timelocks have already been set up, for funds to be transferred from our 3 day timelock treasury to the respective wallets.

The list of wallets and values to be transacted are shown in the image below. You may also view the table here. All transfers will be sent to the respective wallets by Nov 3, 5pm UTC!

We’ll also be transparent that we weren’t able to secure the amount staked in the WMATIC Capsule as someone had siphoned the full amount in that Capsule of around ~10,156 WMATIC before we could act on it.

We’ve traced the transaction to these wallet addresses:

  • Wallet Address 1: 0x779Df019ffB2eB2B29972cf7EA36DA96e245B7dE
  • Wallet Address 2: 0x04AD9bD14276327Ca7784d817E6C26bD77dCFE9d

These are the actions taken by the person:

  1. Performed a withdrawal from our WMATIC Capsule: https://polygonscan.com/tx/0xb21733115e4323b04319fa418d6bf1ba6ec3f034d43a77bf098a19b002a6b54d
  2. Unwrapped it into MATIC: https://polygonscan.com/tx/0x53297589565106488aa06d460d7989a2cfbfcdece68434e4ceaf12c743d7dfe9
  3. Did a test transaction of 2 MATIC to a new wallet (address 2): https://polygonscan.com/tx/0x354a2c1cf9438ab6ef7131afe7532f67d2b35d67a928f502627e5b6322ee6ee1
  4. Sent 5,000 MATIC to the same wallet address: https://polygonscan.com/tx/0x9deadc36496de18d61cc103741c3893ea123158fc43c359b410b403b28043932

This person currently still holds the remaining sum of the un-transferred MATIC in his / her wallet: https://polygonscan.com/address/0x779Df019ffB2eB2B29972cf7EA36DA96e245B7dE

We are hunting this person down and have been posting up TG announcements to look for this individual. We urge him/her to come forward and DM @jkmoriarty or @cookiedeck_v2 on Telegram.

It isn’t nice to sneak off with another person’s hard-earned money. Come forward so you don’t have to live in fear and with a guilty conscience. You’ll not only be doing good, you can also save some people from potentially having thoughts about ending their lives.

We’ll even give you a reward for it — because that’s how much we want people to have their WMATIC returned.

In the meantime, we’re still redeploying our MasterChef as per what we’ve mentioned in our first announcement. This will take slightly longer because of the detour we’ve had to take as detailed above. However, it will still be done within the next couple of days.

Update: 29 Oct

MC has been redeployed and transferred to a 24h Timelock.

MC contract: 0x48b4316eBB5EDa7ecae2A4cEFBDFb66841e1EFA5

Here’s what we did:

1. Forked PolySage MC, which was audited by Paladin. Let’s call this Timeleap MC v2. View PolySage MC Contract.

2. Fixed PolySage’s MC to make it ERC20 compatible (PolySage MC was a fork of BSC token standards)

3. Removed the minting functions from Timeleap MC v2. It will not mint any more TIME tokens since we have reached max supply. However, farming still continues due to our Buyback-and-Make tokenomics.

4. These are the MC settings:

- Max deposit fees of 4%

- Current emission rate of 0.00125 TIME / block

- Max emission rate of 0.05 TIME / block

- MC no longer mints 10% of TIME to devAddress (since we’ve hit max supply, there will be no minting capabilities, TIME will forever have a max supply of 86,400)

5. We’ve added the same Capsules & Timeleaps back. They can be viewed under the Capsules page on our site: https://timeleap.finance/capsules.

Yes, we merged Timeleaps into the Capsules page. Timeleaps and Capsules now function similarly to Wormholes. This means you just need to stake a single currency and withdraw in the same currency — even for LPs since there’s no longer a need for manual forming of LP!

These 10 are found on the new Capsules page:

- WMATIC-TIME (10x)

- TIME-WETH (25x)

- USDC-TIME (25x)

- WMATIC (10x)

- USDC (10x)

- USDT (10x)

- DAI (10x)

- WETH (10x)

- WBTC (10x)

- LINK (10x)

6. We’ve decided that we will not be collecting any deposit fees (Note that there will be a small 1% withdrawal fee when you stake in Capsules)

7. Last but not least, we’ve also contributed 378 TIME from the devAddr (approx 7 days of farming duration just to ensure that farming of TIME continues). We will review this on a weekly basis in order to ensure that the Buyback and make system is running smoothly. Our goal is still to ensure a sufficient float of 2,160 TIME before raising emission rates.

We’ve always been very transparent with y’all because as yield farmers ourselves, we understand the worries you have when investing in a project. We’ve also lost money before and understand the pain — old timers would know that we lost a quarter of a mil from IRON previously, still having PTSD from that.

The community in our TG has been one of the most supportive thus far, and it has been a great validation for us that being transparent is the right thing to do (hence this long essay).

And as always, we remain 100% committed to this project. If you’ve been with us for a while, you’ll realize that we’re constantly pushing out new updates although we’re just a core team of two. And this is despite us being some of the most active devs who speak to you on a daily basis.

Although this issue has been an obstacle, we also work fast (secured approx ~80% of the Capsule funds, deployed a 3 day timelock treasury to safekeep funds, sorted out the funds to be returned to the respective wallets, queued timelocks for the transactions, redeployed MC).

We’ve always been in this to create a farm revolution and our own private DeFi bank. Our roadmap was updated a few days back, and there’s lots of exciting stuff planned for the rest of 2021 and 2022.

All of that is still gonna happen, so stick around and trust in us. We’ve always delivered and will continue to do so.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Timeleap

Timeleap

37 Followers

Action RPG that empowers gamers (with assets that have real value) and provides a sustainable play-and-earn experience.