Alpha Finance (ALPHA)

Basics

• Based in:
• Announced on:
• Mainnet release:
• From EthHub #34 (5-10-2020):

"Alpha Homora is a protocol for leveraging your position in yield farming pools, or "dYdX for yield farming on Uniswap.""

Audits & Exploits

• Has a $750k active bounty (9-12-2021).
• The single admin key is referred to in the protocol as the "governor". This privileged role was called out in Open Zeppelin's audit of the protocol (25-5-2021).
• Peckshield and Quantstamp audited the hacked code (20-7-2021).
• Scored 26% on DeFi Safety (9-12-2021):

"Contracts could not be found in either the docs or the GitHub. No audits specify the address of the contracts. Despite three audits no listed contracts mean we cannot award points for them as per guidance.

There is software function documentation. No tests for code coverage were seen, but it's clear that this protocol has undergone testing. No formal verification has been undertaken. No testnet deployment was documented."

Bugs/Exploits

• From Blockthreat (4-11-2021):

"Alpha Finance patched a vulnerability in its Alpha Homora V2 contract which allowed MEV bots to arbitrage a significant slippage percentage."

• IronBank ($CREAM) was exploited for $37.5M (13-2-2021). From DeFi Weekly:

1. "The attackers is the only user who is in the (announced) sUSD pool for Alpha Homora
2. The attacker borrows ETH from Cream’s Ironbank by using the sUSD as collateral
3. The attacker then repay the debt accrued from borrowing the sUSD, however due to a very minor borrowing error he is able to profit a very tiny amount through this exploit
4. The method to make this tiny profit is then re-executed multiple times in order to reach a size where the profit exceeds well into the 7 figure range
5. The hacker has outstanding debt to the Ironbank via Alpha Homora but of course is never going to repay it
6. Hacker starts washing funds through Tornado and gives a friendly donation of 1,000 ETH to Alpha and Cream in the process

Important clarification: Cream lenders haven’t directly lost money but they have an outstanding loan from Alpha Homora that needs to be repaid. Alpha as a platform is a borrower on Cream similar to if the ALPHA token was used as collateral.

What’s interesting here is that Alpha received 2 audits and yet this exploit still happened. The exploit is so complex it took many researchers and developers hours to truly understand what really went down suggesting that even the existing audit capabilities we have don’t fully measure up."

• From Secureum (7-3-2021):

"Overall, there were some red flags raised by the two audits, less than a month before the exploit, which were all fixed. But the exploited vulnerable scenario was present in the audited contract and remained undiscovered because of the complex constraints under which it could be triggered.

The exploited scenario was not a common Solidity coding pitfall that could have been detected by automated tools checking for security best practices. It was a complex set of constraints particular to the exploited contract’s logic and its interaction with other protocols. It is hard to say if more/better design/code/security reviews could have caught this earlier. Although Quantstamp’s audit did call out the need for better specification and more testing given the complexity of features and interactions, that’s often true for most projects."

Governance

Admin Keys

• From DeFi Safety (9-12-2021):

"Admin Control information could not be found. Pause Control information could not be found."

• From DeFi Watch (31-5-2021):

"I recently discovered that Alpha Homora v2 (currently around $700m TVL) is fully upgradable by an EOA (externally owned account) admin key. An EOA is essentially a normal single-signer, non-contract Ethereum account with no ability to use multisig or timelock protections."

• The Alpha team responded with (31-5-2021):

"Hi @ChrisBlec, we're transitioning this to multisig and actually have been researching on a tool, which is developed by another great DeFi team, to achieve the best programmatic way to execute multisig transactions So definitely going to transition pretty soon once"

DAO

• From Yield Farmer (14-8-2021):

"Alpha Finance Labs announces plans to decentralize its ecosystem via the launch of Alpha DAO."

Token

Utility

• From their blog (23-3-2021):

"With the new ALPHA tokenomics, ALPHA token holders will be able to stake ALPHA tokens to earn fees from the whole Alpha ecosystem regardless of which chains or layer-2 solutions the Alpha products are built on. Once ALPHA tokens are staked, you will be able to ‘unlock’ unique features on the Alpha products when using those products as an ALPHA staker."

Technology

• Whitepaper can be found here.
• Code can be viewed here. However, from DeFi Safety (9-12-2021): "Contracts could not be found in either the docs or the GitHub. No audits specify the address of the contracts."

Which is an interesting combination with the following:

"At 400 commits, Alpha Homora demonstrates a good commitment to strong documentation practises."

Implementations

• Built on: Ethereum and Binance Smart Chain (3-3-2021). Avalanche (12-2021). Released V2 on Fantom (15-3-2022).

Upgrades

• From EthHub #137 (27-10-2020):

"New leverage yield farming pool includes WETH/YFI pool. New feature includes Bring-Your-Own-Token (BYOT) feature, a feature that allows yield farmers to supply another token that’s not ETH and can reduce slippage to 0% when opening a position."

• From EthHub (18-5-2021):

"Alpha Homora V2 Live on Ethereum. Get access to leveraged yield farming with Alpha Homora and partners including Cream Finance, Uniswap, SushiSwap, Curve and Balancer."

• Alpha Homora V2 integration with Ethereum Push Notifications Service (EPNS) is now live (16-7-2021).

Staking

• From their twitter (27-4-2021):

"54,754,914.33 $ALPHA staked - 879 addresses currently staking - Stakers on average are staking over 98% of the $ALPHA in their wallet.

Largest wallet staking over 9.5 million ALPHA - accounts for >75% of the wallet's $18M worth of assets based on what's trackable by @zapper_fi"

Oracle Method

• Integrated with Band Protocol (10-5-2021). Also integrated Band on their Optimism Homora V2 implementation.
• From the announcement of Alpha Oracle Aggregator (10-5-2021):

"Alpha Finance Lab is excited to announce the launch of Alpha Oracle Aggregator, with data from two of the largest data oracles providers, Band Protocol and Chainlink, to ensure scalability, flexibility, and security."

Their Projects

Alpha Homora

• Leveraged yield farming product that captures the market gap in lending.

AlphaX

• From Paradigm (12-2020):

"AlphaX detailed, a decentralized, non-orderbook perpetual swap trading market. AlphaX will not only allow Alpha Homora users to hedge their leveraged yield farming/liquidity providing positions, but will also bring the DeFi space a new class of trading products previously unavailable on-chain."

Roadmap

• Can be found here (7-7-2021).
• Announced its V2 upgrade will be rolled out in Jan. 2021. Happened in May.

Usage

• From The Defiant (28-1-2021):

"Its token and TVL are soaring, with ALPHA climbing to join the top 100 coins by market cap, while it has attracted $600M of assets in just four months."

Projects that use or built on it

• From the yEarn blog (11-1-2021):

"Yearn v2 will coincide with an update of C.R.E.A.M v2 (Iron Bank) and will enable Yearn yVaults to develop leveraged yield-farming strategies and cross-asset strategies utilizing Alpha Homora. Users will be able to deposit DAI and borrow an equivalent dollar amount of ETH via C.R.E.A.M and enter SushiSwap liquidity pools utilizing Alpha Homora’s leveraged yield-farming product. Users will ultimately be able to obtain 90x leverage on stablecoins or 80x leverage on ETH to farm SUSHI, CRV, ALPHA. If the user uses Yearn yVaults they will also potentially be eligible to earn PICKLE."

Pros and Cons

Cons

• Got into trouble with Iron Bank after an exploit left bad debt and Alpha didn't pay. The situation showed the centralized nature of their cooperation. Instead of mathematical certainty, they got frozen funds, broken promises & legal threats (5-3-2023).

Team, Funding, Partners

Team

• Full team can be found here (9-12-2021).
• Alpha Finance Lab

Partners 

• From EthHub #138 (2-11-2020):

"Alpha Finance Labs announced a partnership with Siam Commercial Bank, one of the largest commercial banks in Thailand to work towards bridging traditional banking and DeFi."

• Partners include Balancer, Curve, Cream and Sushiswap (11-1-2021).

(:

Knowledge empowers all and will help us get closer to the decentralized world we all want to live in!

Making these free wiki pages is fun but takes a lot of effort and time.

If you have enjoyed reading, tips are appreciated :) This will help us to keep expanding this archive of information.

ETH tip address: 0x83460bE5F218b1520B69D702cE60A1DE37dD8E31

Also check out CoinTr.ee for more content.