Your runbook when a position is at risk

Graduate · enrolled learners

This lesson opens with Rari Capital and Fei Protocol Fuse, 30 April 2022.

What happened

Rari Capital's Fuse let anyone spin up isolated lending pools from a fork of the Compound code, and Rari had merged with Fei Protocol under the Tribe DAO. On 30 April 2022 an attacker exploited a reentrancy vulnerability in the Fuse pools: the borrow function sent the borrowed ETH before it recorded the debt, so during that call the attacker re-entered through exitMarket, which re-entrancy protections added in March had not covered, and withdrew all the collateral while keeping the borrowed ETH. Funded by flash loans and repeated token by token, the exploit drained seven Fuse pools of about 80 million dollars between roughly 9:00 and 9:35 UTC. Because the pools shared the vulnerable code, the attack moved from one to the next, and users with funds in Fuse had a window of about half an hour as it did. Tribe DAO voted in May 2022 to reimburse affected users, reversed that in June, and in September 2022, as part of dissolving the DAO, passed an on-chain vote to repay the full amount.

The decision point

When the Fuse exploit was running, users with funds in the pools faced the worst possible conditions for a good decision: minutes, high stakes, incomplete information, and an exploit spreading through code they could not read. That is precisely when deliberation fails, and it is why the response clock from the last lesson is only fast if the thinking was done beforehand. A runbook is that prior thinking: a written sequence of actions for when a position is at risk, decided in calm and executed in panic. It answers, before the moment, how you confirm an alert is real, how you find your exposure, in what order you act, and what you can and cannot control. In a half-hour window, the only users with any chance to act were those who already knew where their funds were and how to pull them; that is the lesson's reading, not a finding about specific users, and a runbook is how you become that user before the day you need to be.

Recorded loss

$80,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.