Registration for the Treasury Grant Program has opened. Please check this link for more details: https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/
A. Background
1. There are five categories of assets (“Affected Assets”) contributed by KyberSwap users (“Affected Users”) to KyberSwap Elastic Pools (“Affected Pools”) affected by the KyberSwap Elastic Exploit – which Affected Assets were either (a) removed from the Affected Pools by the KyberSwap Elastic Exploit or (b) were locked in the Affected Pools due to the KyberSwap Elastic Exploit and incapable of being withdrawn by Affected Users from the Affected Pools:
| Category | Description | Reference Value |
| Category 1 | Affected Assets taken from Affected Pools by the primary KyberSwap Elastic Exploit (“Primary Exploit”) which commenced on November 22, 2023 at 10:54 PM UTC, which Affected Assets have yet to be recovered * *Includes liquidity positions and LP fees |
US$48,883,930.66 (being the market value of Category 1 Affected Assets in USD as quoted on CoinGecko at the last block prior to the Primary Exploit) |
| Category 2 | Affected Assets taken from Affected Pools by subsequent activity (“Category 2 MBA”) of two mimicking bots mimicking the Primary Exploit, which Affected Assets have yet to be recovered *Includes liquidity positions and LP fees |
US$172,148.52 (being the market value of Category 2 Affected Assets in USD as quoted on CoinGecko at the last block prior to the Category 2 MBA) |
| Category 3 | Affected Assets taken from Affected Pools by subsequent activity (“Category 3 MBA” which together with Category 2 MBA collectively referred to as “MBA”) of two front-run bots mimicking the Primary Exploit – which Affected Assets have been partially recovered along with assets (“Category 3 Swapped Affected Assets”) into which part of such Affected Assets have been swapped into by such front-run bots. |
US$6,405,483.43 (being the market value of Category 3 Affected Assets in USD as quoted on CoinGecko at the last block prior to the Category 3 MBA) |
| Category 4 | Affected Assets presently locked in Affected Pools due to incorrect pool state as a result of the Primary Exploit and MBA. |
US$24,478.93* *Composition of US$24,478.93 as follows : (a) US$9,390.51 is the Reference Value of Affected Assets within Category 4 attributable to Primary Exploit being the market value of such Category 4 Affected Assets in USD as quoted on CoinGecko at the last block prior to the Primary Exploit; (b) US$15,036.04 is the Reference Value of Affected Assets within Category 4 attributable to Primary Exploit being the market value of such Category 4 Affected Assets in USD as quoted on CoinGecko at the last block prior to the Category 2 MBA; and (c) US$52.38 is the Reference Value of Affected Assets within Category 4 attributable to Primary Exploit being the market value of such Category 4 Affected Assets in USD as quoted on CoinGecko at the last block prior to the Category 3 MBA. |
| Category 5 | Affected Assets previously locked in Affected Pools due to incorrect pool state as a result of the Primary Exploit, but which have been recovered from such liquidity pools. | $706,162.85 |
Each of the Affected Users has one or more wallet addresses (“Affected Address(es)”) associated with Affected Pools and from which Affected Users had contributed assets as liquidity to Affected Pools. The liquidity contribution position of each Affected Address to each Affected Pool is represented by NFTs issued to each Affected Address.
2. Affected Users will be able to see Affected Assets in Affected Pools that are attributable to each Affected Address that were taken from the Affected Pools by the Primary Exploit, via the following link: https://kyberswap.com/elastic-snapshot.
However, some Affected Users will not be able to see their Affected Assets per Affected Address via the above link if these Affected Assets had interacted with third party smart contracts (“Third Party Smart Contracts”) (“Third Party Affected Assets”)
(If you are a project which integrated KyberSwap Elastic and represent Third Party Affected Assets, please contact us for a solution for your Affected Users at: [email protected], with the subject line: “Exploit: Third Party Affected Assets”.)
B. KyberSwap Elastic Exploit Treasury Grant Program :
1. KyberSwap users along with our KyberSwap ecosystem partners such as code developers, code auditors and cybersecurity experts have always been the pillars of support for the KyberSwap ecosystem.
2. Over the years, KyberSwap has supported the KyberSwap ecosystem build through grants from the KyberSwap Treasury.
3. In our continuing efforts to stand by Affected Users especially those in distress or hardship resulting from the loss of Affected Assets that have not been recovered, we are implementing the KyberSwap Elastic Exploit Treasury Grant Program (“Program”) to support Affected Users who have lost Affected Assets within Categories 1, 2 and 4 to the KyberSwap Elastic Exploit – as there is as yet no recovery of Affected Assets within these categories – and who fulfil eligibility requirements of the Program (“Eligibility Requirements”) and agree to and comply with the terms of such treasury grant (“Grant Terms”) offered to them.
4. Under the Program, an Affected User who fulfils Eligibility Requirements can choose from one of the following options for the Treasury Grants in respect of each Affected Address of such Affected User :
| Treasury Grant Option | Details of Option of Treasury Grant in respect an Affected Address of such Affected User |
| Option A | USD stablecoins equivalent of 60% of Reference Value of Affected Assets associated with such Affected Address, vested over 3 months* |
| Option B | USD stablecoins equivalent of 100% of Reference Value of Affected Assets associated with such Affected Address, vested over 12 months* |
| Option C | Opt out |
5. Eligibility Requirements and Grant Terms
Only Affected Users who have lost Affected Assets within Categories 1, 2 and 4 who in their use of KyberSwap had fulfilled the Eligibility requirements under the Terms of Use of KyberSwap will be eligible to be considered for Treasury Grants. The Terms of Use of KyberSwap are accessible at https://kyberswap.com/files/Kyber%20-%20Terms%20of%20Use%20-%2020%20November%202023.pdf.
Affected Users who are eligible to be considered for Treasury Grants under the Program are hereinafter referred to as “Qualified Affected Users”.
In addition, as the Program is separate from the permissionless product offerings of KyberSwap, Affected Users who opt to receive a Treasury Grant will also have to complete a KYC process prescribed by KyberSwap before in order to be eligible to be offered a Treasury Grant they have opted for. This is to verify Qualified Affected User status, and to ensure compliance with Grant Terms.
(Note that KyberSwap is aware that this may concern some Affected Users, and is exploring solutions such as zero-knowledge KYC and a possibility to only apply KYC requirements above a certain Affected Assets per Affected User threshold.)
Qualified Affected Users will be offered a Treasury Grant based on their selected Treasury Grant Option subject to Grant Terms to be announced. These Grant Terms will include Treasury Grant refund requirements in the event that some or all Affected Assets are recovered.
6. Timeline:
Qualified Affected Users will be able to select their preferred Treasury Grant option and start receiving Treasury Grants based on the following timeline subject to their agreement to and compliance with Grant Terms applicable to their respective Treasury Grants:
● January 19, 2024 – 14:00 UTC: UI to select an option to receive a Treasury Grant will go live (“Treasury Grant UI”) and be shared via Kyber Network official accounts. The process will also include Qualified Affected User completing KYC verification.
- The link to the UI will also be shared via DeBank messages (https://debank.com/hi) to Affected Addresses with significant Affected Asset amounts, where applicable, in an increased effort to notify Affected Users. Please note to watch out for scam messages and do not click phishing links. When in doubt, do not click!
● January 31, 2024 – 14:00 UTC: Deadline to complete the KYC process and select a Treasury Grant option.
- Qualified Affected Users who missed the January 31 Treasury Grant Program registration deadline will still be able to complete registration steps. However, grants will be processed at a later time. Grant processing timelines for subsequent batches will be announced here, starting with information on the second batch, which will be announced on February 24, 2024 at 14:00 UTC.
● February 6, 2024 – 15:00 UTC: For Qualified Affected Users who complete the required steps by the January 31 deadline, a function to read and accept Grant Terms and claim Treasury Grants will become available on the Treasury Grant UI. The distribution of Treasury Grants will be executed in accordance with the Grant Terms associated with each Treasury Grant option.
- Note that the Treasury Grant vesting schedule will still commence from February 1, 2024 at 14:00 UTC for Affected Users who complete Treasury Grant Program registration and are deemed eligible, and who also agree to and fulfill the requirements under the Terms of Grant.
For Qualified Affected Users who want to select an option for an Affected Address with Third Party Affected Assets, information can be found here.
Affected Assets Under Category 3
Reference Value of Affected Assets under Category 3 total US$6,405,483.43.
The owners of the two front-run bots that engaged in Category 3 MBA and had taken Category 3 Affected Assets from Affected Pools eventually returned Affected Assets with a Reference Value of ~$5.17m (being the market value of such recovered Category 3 Affected Assets and Category 3 Affected Swapped Assets in USD as quoted on Coingecko at the time of recovery.)
Arrangements are being made for return of the recovered Category 3 Affected Assets and Category 3 Affected Swapped Assets to Affected Users who had lost Category 3 Affected Assets to the Category 3 MBA.
Affected Users who own Affected Assets under Category 3 can check their respective Category 3 Affected Assets per Affected Address at: https://kyberswap.com/elastic-snapshot. KyberSwap will be updating this link to display the claimable amount and tokens as well as a claim function. These updates are expected to be available on January 19, 2024, at 14:00 UTC.
Affected Assets Under Category 5
After the Exploit, some tokens remained locked in some of the affected pools due to incorrect pool states. The KyberSwap team worked with security researchers to recover most of those locked tokens, which made up a USD value of $718k at the time of the Exploit, based on a snapshot taken at the last block prior to the Exploit. These recovered assets are referred to as Affected Assets under Category 5.
The Affected Assets under Category 5 include $KNC and $cbETH, and the recovery is reflected in the following transactions:
● Ethereum tx: https://etherscan.io/tx/0x22dabe7f86947c3b2ccc4679ffcb78038b5a4c9e6cc5444382d430d4628a50c1
● Optimism tx: https://optimistic.etherscan.io/tx/0x8469de31fc3be4853789e31ae288ffc17cb09cc3baa77b73feaf83b511d524d3
Affected Assets under Category 5 will be returned in an amount equal to the total amount of assets recovered and in the token in which they were recovered, to each Affected Address at a proportion equal to the Affected Address’ share of ownership in each Affected Pool. This includes KyberSwap, who owns a significant amount of the Affected Assets under Category 5.
