kpk Liquidity Management is divided into Operational and Yield Farming positions. Operational positions are meant to cover a need or requirement and not necessarily follow a yield on itself. For Balancer EURe/sDAI, the pool served as the primary liquidity position to enable Gnosis Pay interactions which meant that we kept the monitoring focused on 2 separate focus:
- Critical Total losses, as in a general tracking related to the pool funds a whole
- Efficiency, active monitoring for liquidity swaps/slippage/price impact/utilization/volume
It was understood that even a stable pool could have variations related to its token composition and that was an expected behaviour for the pool math.
Yield Farming position monitoring on the other hand tracks:
- Critical Total losses, as in a general tracking related to the position
- Position health, token amounts, USD values, yield/rewards
What has been changed around this? We revamped the way we track positions to alert us for this kind of issues, including operational liquidity positions.
The questions:
Why did you wait 2 weeks before starting to fix the vulnerability?
Why didn’t you communicate about this vulnerability, while your community was losing hundreds of thousands of dollars, either before or after the problem was fixed?
Why didn’t you produce a counter-report if you were not satisfied with my figures?
Why did you choose to ignore arbitrages via deposits/withdrawals, as well as weekends in the calculation of losses?
Why haven’t you assumed full responsibility as the manager on GnosisChain?
As stated on our original timeline, on February 20th the abnormal volume discovered in the pool led to the review done by kpk, gnosis and balancer. This review was done over this 2 week period. Measure twice, fix once.
On the communication side, we already admitted fault. We were more concerned to solving the issue and not enough on communicating it.
Arbitration between deposits and withdrawals was ignored as it represented less than 0.1% of total transactions over the review period (<300 out of 330k transactions reviewed). The calculation normalizes the swap outcomes vs expected outcomes, irrespective of the day of the week.
kpk maintains a duty as GnosisDAO treasury manager which is where our responsibility ends, there was no loss of principal for GnosisDAO assets but as stated here we returned 774.1735 GNO as a symbol of goodwill.
DeFi liquidity in general follows USD values, and growing meaningful foreign exchange liquidity has been one of the core points we have worked on and will continue improving.
This work is never ending since some of the projects do not have organic volume, so part of the work done is also maintaining correct pricing. But the treasury cannot provide liquidity for every single token .