GIP - 127: Should GnosisDAO reimburse liquidity providers in the Balancer EURe/sDAI pool for lost opportunity caused by the issue reported by NolanV?

[Karpatkey]

GIP - 127: Should GnosisDAO reimburse liquidity providers in the Balancer EURe/sDAI pool for lost opportunity caused by the issue reported by NolanV?

• In Favour
• Against

GIP: 127
title: Should GnosisDAO reimburse liquidity providers in the Balancer EURe/sDAI pool for lost opportunity caused by the issue reported by NolanV?

author: kpk

type: Funding

created: 2025-07-01

duration: 3 months

funding: 330,000 xDAI distributed over three months, plus 33,000 xDAI bounty for NolanV

This communication aims to address an issue that was identified with the EURe / sDAI stable pool on Gnosis Chain, regarding a misconfiguration of the parameters.

Introduction

The pool has played a meaningful role in supporting Gnosis Pay’s growth over the past 18 months, and we are treating recent reports with the seriousness they deserve.

The pool was created on October 3, 2023, using Balancer’s permissionless infrastructure. The pool design utilized Balancer’s StablePool technology with a rate provider intended to concentrate liquidity around the EUR/USD spot price. However, at the time of creation, the rate provider cache duration was configured to 3 hours. This configuration introduced windows where stale pricing could occur, allowing arbitrageurs to capture value. As a result, we estimate that LPs may have incurred aggregate losses of up to 330,000 USD. The higher volume activity observed during these windows did not translate into sustained fee generation for liquidity providers.

Timeline

• October 3, 2023: Pool was created on Gnosis Chain.
• February 20, 2025: An internal review of Gnosis DAO liquidity positions revealed a loss in the EURe / sDAI pool. This led to a broader analysis of the pool’s configuration. It was determined that the Rate Cache Duration needed to be updated.
• March 4: A BIP was initiated by Balancer governance to grant the necessary permissions.
• March 5–10: Governance voting period.
• April 7: Execution completed. The Authorizer role updated the rate cache duration to 1 second. Community member NolanV surfaced the issue in the DeFi Francophone community.
• April 9th: NolanV submitted a full independent report: https://nolanv.be/05ba85ec-bada-48bb-aa1c-e102371b4beb/

Estimate of Loss

With support from the Balancer data analytics team, we assessed the issue by simulating a counterfactual scenario where the rate cache duration had been set to 1 second from the start, to determine the hypothetical losses. This is equivalent to the liquidity providers’ opportunity cost (rather than realised losses to their principal). The delta between that and actual pool behavior formed the basis for our loss estimate.

This required a detailed archive and simulation of all transactions in the relevant period, which has taken us time to perform. We are now finally in a position to share the full analysis, which is available in this repository: GitHub - mendesfabio/eure-sdai-indexer: https://eure-sdai-indexer.up.railway.app/ · GitHub

This differs from NolanV’s approach, which used Binance EUR/USDT prices as a proxy, explaining the variation in estimates. Nonetheless, we are grateful to NolanV for their efforts and transparency, and acknowledge and apologise for the long delays noted in their incident report (which were needed to complete our comprehensive estimate of loss).

In summary, we find that – absent the misconfiguration – liquidity providers in the pool would have received in aggregate up to 330,000 USD more from their positions. Though this is not a loss of principal, the liquidity providers did receive less than they should have, and as such we agree with nesk that a reimbursement is appropriate here (including a bounty for NolanV).

Implementation Plan

We propose this GIP to support LPs affected by this issue by offering a targeted boost, and the Balancer team is working to ensure smooth implementation of the distribution mechanism from a technical standpoint.

Additionally, we are also proposing a 10% bounty (33,000 USD), to be paid in full to NolanV, in recognition of his contribution to the discussion and data analytics provided.

Boost Design

• Eligibility: LPs who were in the pool until April 7, 2025
• Budget: 330,000 USD
• Distribution Period: 3 months
• Conditions: Weekly distributions based on continued participation in the EURe / sDAI pool

Details regarding eligibility, including participation via secondary sources (e.g. Aura BPT and Beefy Vault), will be shared before distribution is enacted.

[mrtdlgc]

As specified in the service provision contract between the Gnosis DAO and kpk, kpk secures its position for not being held accountable in case of any third party risk. So, legally, I see Gnosis DAO assuming risk here and will vote in support of this proposal.

However, ethically, it does not sound great and again brings the heavy reliance on kpk without any responsibility as a service provider due to the fact they handled the situation pretty poorly with lack of transparency until a person affected decided to publicize the fault.

The better course of action in such cases would be that kpk reimburses individuals without going to a DAO vote, which might turn out to be a contested one, and further delaying the reimbursement of affected users. And this is again another bad look on kpk’s part whose main responsibility is to enable a thriving and secure DeFi ecosystem on Gnosis Chain.

So, I would like the DAO to reconsider its relation with kpk as its sole partner for its financial affairs due to an accumulated not-very-ideal treatment by kpk in their provisioning of services for Gnosis DAO.

[friend]

Following on from @mrtdlgc comment, it seems important that situations like this are resolved so as to reduce the likelihood of the problem’s recurrence, in part by identifying the incentive structures in place. In this case, whoever set the cache duration should be disincentivised from getting it wrong and, at least, share in the downside of a suboptimal setting. If that is kpk (not stated in the original post), then a preferable incentive structure would see kpk face some penalty, an example of which is described by mrtdlgc.

I would vote in favour of this if it sought to address these systemic issues (even if that only involves committing to a meaningful appraisal of the situation with follow-on actions) as well as reimbursing individuals.

[refri]

Regarding the proposal I am a bit ambiguous, a mistake like this can happen, no one really took a real loss but only less gain, also, as I reed somewhere else, most of the liquidity were DAO funds, so in part this is a refund to ourself.

The Bounty to NolanV is highly appreciated by me, not so much cause the discovery of the incident (which has been known by kpk before) but cause it showed the insufficient communication regarding this.

@Karpatkey

Timeline

• October 3, 2023: Pool was created on Gnosis Chain.
• February 20, 2025: An internal review of Gnosis DAO liquidity positions revealed a loss in the EURe / sDAI pool. This led to a broader analysis of the pool’s configuration. It was determined that the Rate Cache Duration needed to be updated.
• March 4: A BIP was initiated by Balancer governance to grant the necessary permissions.
• March 5–10: Governance voting period.
• April 7: Execution completed . The Authorizer role updated the rate cache duration to 1 second. Community member NolanV surfaced the issue in the DeFi Francophone community.
• April 9th: NolanV submitted a full independent report: Balancer sDAI/EURe incident report - NolanV

Looking at this timeline I ask myself what might have been the appropriate time to inform the broader public, at least Gnosis-DAO members. Although I check the balancer forum from time to time I missed this topic there.
Regarding DAO-funds managed by kpk I would prefer a place either her or at kpk site where these issues can be communicated in time. Ofc there might be reasons to withhold info from the public if it might increase harm due to further exploitation and it might also be a valid argument if it would harm some other projects (like gnosis pay). But in these cases it should be clearly emphasized afterwards what are the reasons for delayed communication at which point.

Regarding this case imho, at least at the time of the BAL proposal there should have been some info to the DAO community.
Maybe kpk could add a section for these kind of topics in their monthly reports?

[CryptosNF]

As for me, I used the pool and didn’t immediately realize there was an issue. I took my share and stopped using the pool.

However, regarding the proposal that the Gnosis DAO should reimburse the funds, I would be in favor of it, because liquidity providers are what allow Gnosis Pay to continue operating.

That said, I don’t see why the DAO should bear the full responsibility for this, especially since KarpatKey was behind this pool (along with Balancer and Gnosis, of course).

And should the DAO really have to reimburse something when the team managing the DAO’s treasury wasn’t even informed? To me, that’s a problem.

Even if, factually, KarpatKey might not be contractually liable, I still believe they hold at least some responsibility — especially given the lack of communication with affected parties or even those who could have been affected.

Not to mention that KarpatKey received management fees for DeFi operations while this pool was running.

So in my view, some form of compensation from the KarpatKey entity wouldn’t be unreasonable — far from it.

If that doesn’t happen, I think it should call into question KarpatKey’s management mandate and the significant dependency on Gnosis Chain.

Mistakes happen, and I don’t want to throw fuel on a fire that’s already burning, but responsibilities still need to be acknowledged.

Even if it’s outside the scope of the contract, I believe there’s also an ethical and moral dimension that matters here.

So this is something worth exploring, in my opinion.

I also fully support the bounty for @NolanV , who has been sounding the alarm for a long time and provided an excellent report.

Perhaps KarpatKey should partially compensate him using the entity’s own funds — not the DAO’s.

Beyond this specific incident, I think it’s important that this raises broader questions in the debate — about potential future risks and KarpatKey’s lack of non-contractual accountability when these kinds of things happen, which, in my opinion

[CryptosNF]

Any upadate for this ?

[NolanV]

[refri]

the ‘team’ (or ltd?) seems to be busy with other stuff, maybe gnosis pay rewards, idk…

[StefanGeorge]

Thank you for patiently participating in this discussion, and thank you to KPK for this proposal. I communicated with KPK that I will respond here; the delay is on me.

I am personally one of the largest LPs in this pool, as well as a large GNO token holder, and can represent both sides.

I discussed with our team, and we would like to treat it similarly to how we would treat a bug bounty. In general, if we make a change to the code, it applies for a bounty. In this case, we changed the setup, which improved the performance of the pool.

This is why we suggest rewarding NolanV with 10k USD for his contributions leading to surfacing the problem, similar to our approach to bug bounties in code.

Providing pools with RWAs is cutting-edge DeFi. Issues can be expected and are not necessarily easy to solve. In this case, even after the fix was implemented, it took a month to be applied, going through the Balancer governance process.

The current agreement with Karpatkey doesn’t include any SLAs or penalties in case things do not work out as expected. In this case, the first issue was that it was never defined what the expected behaviour should have been in the first place. We are now working with KPK on an updated agreement, which is addressing those issues, with clear KPIs defining the expected outcome.

KPK has agreed to provide additional incentives for the users valued $100k in GNO.

I see this as an important lesson learned to improve the offering of stablecoins on Gnosis Chain. There are many more to come, and we have to make sure our offering is competitive.

We will edit the proposal and post it on Snapshot.

[NolanV]

I’m just going to take a few minutes to correct some misinformation that seems to still be circulating here and to once again highlight what’s important and why I busted my ass for weeks doing kpk’s job.

To start, no, this is not a complex product. Providing liquidity on the forex market is something a first-year student can do. If you can’t do it, that’s concerning. The real reason for this loss is the lack of oversight by kpk and Gnosis’s very “laid-back” approach to managing its money (to put it politely).

Next, liquidity providers lost money. Stop with your marketing jargon, with sugarcoating things. KPK/Balancer MADE liquidity providers LOSE money.
You can see on this chart—I’ll explain it so even my 6-year-old nephew can understand—if the line goes down, it means it’s not good. Especially since the EUR/USD price went up during the same period. Yes, it’s crazy, I know, but if the EUR/USD price rises, the pool is mechanically supposed to appreciate as well, not the other way around.

Now that everyone understands the pool lost money, we can talk seriously. The work kpk did to “recalculate” my figures is a complete joke. I wrote it in my report, I gave them my code, I told them on Telegram that some arbitrages were not detectable via swap events, yet their code doesn’t account for it. Then, the icing on the cake, they removed the arbitrage caused by not updating the price over the weekend. Why? No idea. Even though that’s the heart of the problem! Even ChatGPT understands that you shouldn’t use an outdated price as the mid-price for a pool, but WTF, why do I have to explain this?

Finally, you (kpk, balancer, gnosis) covered up this problem and didn’t communicate about it for weeks, not to protect the funds from a potential theft, no! It was to prevent liquidity from migrating and GnosisPay from suffering. To me, this is a disgrace and doesn’t at all match the image I had of Gnosis.

Mistakes happen, but if you (Gnosis, KPK, Balancer) react like this to a mistake with so few consequences, sorry, but you are not serious people, and I advise anyone reading this post not to trust you in the future.

I refuse to touch a single cent and, by doing so, endorse what looks more and more like a simple extraction from the GnosisDAO treasury.

Merde.

[tdino93]

You’re a good guy, Nolan. Thanks for this explanation.

Having been a (minor) LP in this pool, it didn’t take me long to realize something was ‘off’. Didn’t have the technical background to corroborate, but left the pool with a minor loss and some annoyance. I agree that these types of pools should be the easier, safer ones to manage, and I’m a little puzzled as to why this didn’t work on Gnosis but seems to be fairly straight-forward on other chains and with other forex-linked coins.

[OliDotNet]

Hi Nolan,

Just wanted to say I really respect the way you handled this. Sharing your findings openly, and then refuse to take a cent when you felt the process wasn’t honest. That’s really honorable, especially in a space where most people would just grab the payout and move on.

So yeah — big respect.

[JoeD]

Hi Stefan,

Will you guys give the stolen money back at any point to all the liquidity providers?!

[refri]

@StefanGeorge

I am personally one of the largest LPs in this pool, as well as a large GNO token holder, and can represent both sides.

and besides this a man with a large say on Gnosis Ltd and DAO topics. That’s why I would really appreciate your opinion on my question above:

@refri

I ask myself what might have been the appropriate time to inform the broader public

It’s of not much importance for this issue anymore but can lead all gnosis linked entities to perform better in the future.

[StefanGeorge]

Based on the timeline of events outlined by Karpatkey, it would have been best to give notice at the end of February, when the issue was first recognized. I would consider the BIP shortly after a public notice, but with limited reach. At this point, I would still consider this forum to be the best place to alert LPs in case there is any issue. This is what will be done going forward.

In general, I would advise transparently communicating oracle configurations for RWA pools from the very beginning, as they are the most critical part of the pool infrastructure. This should help LPs to rationalise what potential pitfalls are. KPK and Gnosis will do their best to prevent this in the future, but I am also grateful to the community for providing critical feedback and keeping an eye on it.

For now, for LPs, that were impacted, additional incentives are made available as outlined in the GIP.

[refri]

Great, Thanks for this. Hopefully @Karpatkey (and other entities within the gnosis ecosystem) agree on this and modify their communication strategy accordingly.

[felix]

I’ve been an LP in the pool and actually pointed out on the Balancer discord that something looks odd regarding the porformance vs. EUR/USD exchange rates. Back then it was claimed all looks correct. Just saw this proposal has passed now… I removed a part of my liquidity after this proposal has passed (due to not knowing about it). Can I receive my full fair share of future reimbursements if I redeposit the difference?

[BillieJoe.eth]

@NolanV

I’m just going to take a few minutes to correct some misinformation that seems to still be circulating here and to once again highlight what’s important and why I busted my ass for weeks doing kpk’s job.

Why kpk’s job? I think you’re wrong. You are doing our job; your contribution favors liquidity providers. I respect your contribution, but you’ve been checking public information; you must check it if you are an LP.
This case has different responsibilities: Balancer showed a wrong APR that affected the LP decisions, kpk deposited funds from GnosisDAO and created the environment to promote the volume (0 fees), and LPs didn’t check the conditions before. The question is who should be responsible for setting the EURe price on-chain: Balancer, kpk, or GnosisDAO, I think, all of them. EURe is the engine of Gnosis Chain and Gnosis Pay.
The problem was the EURe price (maybe a wrong UI, showing a wrong APR); thus, the responsibility is split between Balancer, karpatkey, and GnosisDAO. Do you think it should be compensated? I think ‘NO’ because the LP is the only one responsible for its decisions; all the information is public. Incentives sound excellent, but I didn’t understand why only Karpatkey covers this. I appreciate their commitment, but Gnosis and Balancer should also be part of this incentive program. I wanna get more incentives on Gnosis Chain!

[BillieJoe.eth]

@StefanGeorge

KPK has agreed to provide additional incentives for the users valued $100k in GNO.

It represents almost 30% of the losses. Will Balancer and Gnosis contribute to this incentive program? I think the main problem was the EURe price (infra of GnosisPay/Monerium) and a wrong Balancer UI.

[NolanV]

@BillieJoe.eth

Why kpk’s job? I think you’re wrong. You are doing our job; your contribution favors liquidity providers. I respect your contribution, but you’ve been checking public information; you must check it if you are an LP.

I don’t think you’ve read my report; I’m putting the link here for you: [Incident report] - Balancer's EURe/sDAI pool on GnosisChain

I’ve said from the very beginning that my problem wasn’t the loss itself, as it was limited for most LPs; my problem is how this incident was handled by KPK, Balancer, and Gnosis. I’ll remind you that for months, KPK didn’t even notice they were losing money on a position funded by GnosisDAO, and that’s the real issue. The reimbursement for LPs is nice to have, but I would have 1000x preferred no refund at all and instead to see KPK truly reflect on this incident.
KPK, Balancer, and Gnosis had been aware of the issue for months and chose to hide it. On top of that, the information was not easily available, the APR was incorrect, the oracle cache was not visible on the website, and the fact that it wasn’t updated on weekends could only be found by digging through Chainlink’s documentation.

@BillieJoe.eth

It represents almost 30% of the losses. Will Balancer and Gnosis contribute to this incentive program? I think the main problem was the EURe price (infra of GnosisPay/Monerium) and a wrong Balancer UI.

The total loss is closer to 700k than 300k. The figure provided by KPK is simply incorrect and doesn’t account for a lot of the arbitrage.

It took me weeks to analyze the total loss of the pool due to the choice of oracle (I invite you to read the report and the code to understand why). I still maintain, perhaps wrongly, that it was KPK’s job to do this, given the mandate and the multi-million dollar compensation GnosisDAO offered them.