Impermax V3 Exploit: Post Mortem

It is with great regret that you learned yesterday, as did we, of an exploit affecting our V3 code.

A sophisticated edge-case was existing and it allowed a hacker, via using a flash loan, to steal around $300k so far.

There is still $300k−$350k at risk: this risk materializes when borrowers repay their loans, making the capital available. Therefore, borrowers must not reduce their borrowing or close their positions until the remediation takes place.

The important thing for users to know is that we will not disappear and we are not giving up. We will stabilize the situation; then, recovered funds will be distributed to lenders based on a snapshot taken right before the hack.

Humbly, we do not yet know the proportions or the timeline for this reimbursement. Our first priority is to salvage the situation and minimize further losses. Then, we will determine when and how reimbursements can be made.

This is neither the first nor the last setback for Impermax. But we need to put things into perspective. The final loss is likely to be around $400k. Should we manage a successful return to the market, this amount is relatively small compared to the vast range of hacks that have occurred in DeFi in recent years.

We are small and have been weakened by this incident, but we are tenacious and dedicated.

Like an Ibex taking cover, letting the storm and the deluge pass. The bad weather will pass, and we will come back stronger.

Technical recap

The hack was made possible by a discrepancy in a valuation between uncollected and auto compounded fees used as collateral. The hacker was able to use this flaw by creating a position with largely inflated uncollected fees, using them to borrow, followed by auto compounding of uncollected fees into the existing position and then stealing them leaving the position with insufficient collateral.

Here’s how he was able to do that:

1) Taking a large flash loan on Balancer (this step is not necessarily possible).

2) Creating an Impermax V3 collateral position on a Uniswap V3 pool with low liquidity.

3) Push the tick to an extreme price in order to make the position out of balance in real terms.

4) Performing a high number of swaps (around 50) to accumulate uncollected fees on his position. At this point most of the value of his position was uncollected fees, not liquidity, mostly accumulated on one side because the position was out of balance. To pull this off, the user must be the only / majority provider within the current active liquidity.

5) Borrowing from Impermax using the uncollected fees as collateral, including the principal position*.

6) Calling reinvest to auto compound the uncollected fees. This action correctly reinvested the fees, but at the wrong tick. This will cause the position to be worth much less when it gets back to the current tick because of impermanent loss.

7) Pushing the tick back to the current tick, in order to extract value from the collateral. At this point the position is fully underwater.

8) Calling restructureBadDebt to close the position and dilute the lenders. Now the lenders’ assets are worth less than they were before the exploit.

With this exploit he was able to:

a) Immediately steal all the current available liquidity.

b) By repeating the process multiple times the attacker used step 8 to smartly dilute lenders. In this way if a borrower repays his debt, the hacker can withdraw the available liquidity before real lenders are able to.

Exploit tx: https://basescan.org/tx/0xad4fc3156666d5402f00dcfd5c183493d283f4166a6dd581dd8c0a895e826a56

*The discrepancy between the valuation of the uncollected fees in comparison with the auto compounded fees which are subject to ratio change based on safetyMargin was the root-cause of the hack.