Summary
No user funds lost. A critical vulnerability was discovered in Primitive Finance smart contracts that would allow all funds to be stolen from Primitive Finance users according to their token allowances. There were 88 potential victims, most with infinite approvals for important tokens, such as WETH or DAI, and with overall holdings of well over $10M. $1.3M of these funds were vulnerable at the same time, the rest only when/if converted to WETH, DAI, or other approved tokens.
Risk to user funds was eliminated via a pre-emptive whitehack by the Primitive Finance team and its war room.
Timeline of…
A critical vulnerability was discovered in Primitive Finance smart contracts. As the contract is not upgradeable or pausable, we chose to whitehack our own smart contracts to safeguard user funds.
WHITEHACKED FUNDS ARE SAFE. ALL WHITEHACKED FUNDS WILL BE RETURNED TO THEIR OWNERS.
TOKENS IN WALLET which have approved the vulnerable contract REMAIN AT RISK, NOT THE PRIMITIVE CONTRACTS WHICH HOLD FUNDS.
Impacted Connector Contracts:
0x69e82d3696B21c200CEf654bc294CACaD01E1Fb3 (old)
0x3256EF5AFb05BbBeC063c16d1052517775E1e9B6 (old)
0x126d852A3150C53B851eB340ea54Dc379d62f27c (old)
0x66fD5619a2a12dB3469e5A1bC5634f981e676c75 (primary)
0xb026991da22f7D8F51550D5f99C39DdBc1c02089 (potentially safe)
0x9Daec8D56CDCBDE72abe65F4a5daF8cc0A5bF2f9 (primary)
Here’s how to safeguard your funds, please do this immediately:
- Go to https://app.primitive.finance/reset
- Click on an available approval reset button and sign…
As decentralized financial markets mature, the layers that form grow larger than their predecessor. It’s visible right now, with lending protocols and asset managers leading the Total Value Locked (TVL) in DeFi. However, derivative protocols are so early that they barely make a dent in the total value moving through the DeFi ecosystem. How long will it take for that to change?
Options are classed into the derivatives block and they will be used by most protocols in DeFi in some capacity. To share some examples:
- Options can be streamed to protocol contributors as incentives.
- Protocols can hedge their treasury’s…
The protocol’s first option market successfully concluded, signalling the first step over the starting line. The next option markets have already been deployed, and V2 development has started.
V2 Protocol Upgrades
- Option AMM to improve slippage by 100x. (This is going to have its own introduction post).
- Upgrade core option tokens with ‘permit’ to remove approvals and therefore reduce overall end-user gas expense by at least 25%.
- Abstract WETH to improve ETH option trading experience.
V2 Interface Upgrades
- Increase app speed by 10x using The Graph.
- Portfolio dashboard to manage all option positions.
- Multi-leg option orders with net credits/debits.
- Option position builder and payoff simulation (LP…
The tokens living on Ethereum are a spectrum of ownership: from art to stablecoins to entire decentralized protocols. These tokens have markets to facilitate swapping, borrowing, and lending, which lay the foundation for the next large markets: derivatives. These decentralized derivative markets allow users to leverage up on ownership and capitalize on the growth of Ethereum.
Primitive is a new protocol that harnesses the power of simplicity to deliver tokenized options for any asset on Ethereum. There are three key features of Primitive:
- The option tokens do not rely on oracles or admins; they operate independently as immutable smart contracts.
- …
tl:dr: Exercising an option will pay you first.
For the past few weeks we have been testing the contracts and optimizing their gas usage. In the process of this, we noticed that by reorganizing the logic in the exercise function, we can enable flash exercises.
Vanilla options are often never exercised because it uses the option. The option had extrinsic time value, which is effectively burned when it’s used. It’s often the case options are sold to close, rather than exercised to close.
Why build in flash exercises then? There is a case where an option is exercised: when the option expires in the money. At this point…
tl:dr: Smart tokens are ERC-20 tokens with extra features.
The ERC-20 standard is powerful for a few reasons, but one of them is how easy it is to build liquidity around. These tokens are plugged into liquidity models with ease, and what we get is a more liquid market that is better for all parties. Liquidity models will continue to grow and iterate towards zero impermanent loss, but what about the tokens?
System Tokens
Many of the most liquid tokens have their value derived from the system it is embedded in. For example, Dai is derived from the Dai Stablecoin System. …
At 11:30 A.M. we announced our alpha release. Two hours later, we discovered a bug.
TL:DR
- The bug prevents purchasing Primes from the Pool.
- Current Prime holders are not at risk due to this bug. If you have Prime tokens, you can still freely exercise. We recommend you do so.
- No funds are at risk due to this bug.
- We paused the Pool, preventing new liquidity from being added.
The Bug
Lines 235–241 are the area of focus here. In line 237, the premium is calculated. If this premium is 0, the transaction will revert with the error: “ERR_BAL_ETH” at line 241. We…
In Greek mythology, the Titan Prometheus steals fire from the Gods and brings it to Earth’s humanist civilization. Also accredited with molding humanity from clay, the rebellious Titan was eternally punished for his theft of fire. However, with fire, humans could extend their civilization beyond their clay limitations and into an energetic force. Innovation preceded by theft against the old gods pushed us forward.
The Primitive Protocol
Primitive designs base smart contracts that operate under the conditions of ignorance and bliss. These primitives serve as tools for protocols on DeFi to use, including our own protocol.
Alpha Release Features:
- ETH Put ERC-20 Token with 200 DAI…
