Following our initial update regarding the exploit on Saturday, 12th September, we’re bringing Chainflip back online with the various fixes to return services to normal. Below outlines how we aim to bring everything back online, in what order, and how we are handling the TronUSDT balances.
Recap of what happened and the fix
Between 01:44 and 03:10 UTC on 12 September, an attacker took 736,442.17 USDT from our Tron vault by getting six LP withdrawals paid out twice.
On Tron, Chainflip reads vault swap instructions from a memo attached to the transaction. The attacker took a fetch transaction our validators had already signed, submitted it to the vault themselves, and attached their own malformed memo. Our witnessing layer read that memo as a failed swap and issued a refund, on top of the attacker's normal LP withdrawal.
The vulnerability that allowed this is now patched.
Until now, Chainflip would read a memo from any transaction that moved funds into the Tron vault, even when the transfer was wrapped inside another contract call. Our own signed fetch transactions are exactly that kind of wrapped call, which is how the attacker was able to attach a memo to one.
The new check is much stricter. A memo is only read as a swap instruction if it comes with a plain TRX transfer or a direct TRC-20 token transfer. Any transfer wrapped in another contract call is excluded, so a memo attached to a Chainflip-signed transaction can no longer create a swap or a refund.
This has one side effect. Users and integrators who send from smart contract wallets, or aggregators that route through their own contracts, won't be able to use vault swaps on Tron as easily as before, because their transfers arrive wrapped. None of our current integrations work this way, so no one is affected today.
Full technical details will be in the PR once the fix is live.
What the network looks like after a restart
When we restart, every service comes back as it was before the pause with the exception of TRON.
The restart plan
Below are the steps that will be taken before we can safely turn on swapping again.
1. Runtime upgrade to process stuck refunds & accounting fixes. Before the exploit, we planned to do an upgrade to refund various users with stuck swaps for various reasons; we are going to stick to this first and get those cleared. This upgrade will also include the accounting fixes needed to resolve the internal accounting as described below.
2. Engine upgrade. Next, we will be pushing an engine upgrade to our validator network. This upgrade is what contains the exploit fix. We will need to get our validator network to reach consensus here before we can move forward. We will be publishing the binaries later today. If you are an operator, watch out for that announcement.
3. Switch back on. Once we are happy with the network stability, we will turn our services back on for swapping, except TRON. Witnessing there will still take time, and once that is caught up, we plan to enable that too and communicate that to all our partners.
We'll post in Telegram,Discord and socials as each step completes.
Tron USDT balances and the shortfall
The Tron vault now holds far less USDT than LPs are owed, so those LP balances will need to be reset. At restart, we'll settle Tron USDT positions like this:
Close all open range orders, strategies, and limit orders, and unwind all loans and lending positions related to TrxUSDT.
Record the pre-migration trxUSDT balance of each LP in a separate on-chain balance so the amount each LP is owed stays tracked and nothing is lost for future payouts.
Next, we set each LP's Tron USDT account balance to zero. For LPs, your account will now read 0 for trxUSDT.
Record how much trxUSDT can be recovered from the vault post-migration and factor into recovery.
Proceed with the recovery plan with impacted LPs to close the remaining shortfall to make LPs whole.
We have plans to deal with the shortfall, and we are in contact with the affected LPs directly with a solution to get their funds back. If we haven't reached out to you, please reach out to Shaun or open a ticket with our support bot.
What happens next
We've flagged the exploited funds with the relevant parties and are continuing to work on recovering what we can.
We're reviewing how memos are handled on every chain we support, not just Tron, and adding monitoring for duplicate payouts.
We are actively reviewing our security practices across the board following the events to further harden our systems.
We are working with affected LPs to make them whole.
A massive thank you to our node operators, LPs, and community for your patience while we get this right.
