Difference between revisions of "Convex (CVX)"

From CryptoWiki

Line 20: Line 20:
===Bugs/Exploits===
===Bugs/Exploits===


* [https://www.blockthreat.io/p/blockthreat-week-9-2022?token=eyJ1c2VyX2lkIjoxMzk3OTAwLCJfIjoiUmlDRzMiLCJpYXQiOjE2NDY5Njc0MjMsImV4cCI6MTY0Njk3MTAyMywiaXNzIjoicHViLTgxMDUiLCJzdWIiOiJwb3N0LXJlYWN0aW9uIn0.b0xE_ZejKQPPFCI7qCMIa0dOd56rmR1SkNBb6r11V-g&s=r From] Blockthreat (7-3-2022):
* [https://blog.openzeppelin.com/15-billion-rugpull-vulnerability-in-convex-finance-protocol-uncovered-and-resolved/ From] [[OpenZeppelin]] (4-4-2022):
''"In late 2021, as part of a security audit for a [[client]], OpenZeppelin conducted a security review of the Convex Finance protocol. As part of the audit, the Security Research Team uncovered a vulnerability that, if exploited by two of three anonymous multi-[[signature]] [[wallet]] (multisig) signers, would have given the Convex multisig direct control over Convex’s locked value—then approximately $15 billion. Convex documentation specifically stated such control was not possible. This vulnerability has since been [https://github.com/convex-eth/platform/commit/0b52856470c389a7ab496786583d200bcb03995a patched] by the Convex Team.''
*[https://www.blockthreat.io/p/blockthreat-week-9-2022?token=eyJ1c2VyX2lkIjoxMzk3OTAwLCJfIjoiUmlDRzMiLCJpYXQiOjE2NDY5Njc0MjMsImV4cCI6MTY0Njk3MTAyMywiaXNzIjoicHViLTgxMDUiLCJzdWIiOiJwb3N0LXJlYWN0aW9uIn0.b0xE_ZejKQPPFCI7qCMIa0dOd56rmR1SkNBb6r11V-g&s=r From] Blockthreat (7-3-2022):


''"Convex Finance redeployed its vlCVX [[contract]] after an unknown [https://convexfinance.medium.com/vote-locked-cvx-contract-migration-8546b3d9a38c vulnerability] was responsibly disclosed to the project."''
''"Convex Finance redeployed its vlCVX [[contract]] after an unknown [https://convexfinance.medium.com/vote-locked-cvx-contract-migration-8546b3d9a38c vulnerability] was responsibly disclosed to the project."''
Line 98: Line 100:
==Roadmap==
==Roadmap==


*Can be found [Insert link here].
*Can be found [Insert [[LINK|link]] here].


==Usage==
==Usage==
Line 105: Line 107:
*From this [https://twitter.com/david_dot_eth/status/1399659712258269188 thread] (1-6-2021):
*From this [https://twitter.com/david_dot_eth/status/1399659712258269188 thread] (1-6-2021):


''"Owning $cvxCRV is so damn juicy that 18.2m $[[Curve Finance (CRV)|CRV]] have been irreversibly locked up in just 2 weeks. For comparison, [[Yearn]] has locked up 17.3m $CRV after ~1 year. Convex crushed Yearn's moat in 2 weeks. It now owns more $veCRV than Yearn."''
''"Owning $cvxCRV is so damn juicy that 18.2m $[[Curve Finance (CRV)|CRV]] have been irreversibly locked up in just 2 weeks. For comparison, [[Yearn]] has locked up 17.3m $CRV after ~1 year. Convex crushed [[YEarn|Yearn]]'s moat in 2 weeks. It now owns more $veCRV than Yearn."''


* [https://newsletter.banklesshq.com/p/is-convex-the-yfi-killer?token=eyJ1c2VyX2lkIjoxMzk3OTAwLCJwb3N0X2lkIjozNzY3NjI2MSwiXyI6IitrN3VtIiwiaWF0IjoxNjI0MTk5MDY0LCJleHAiOjE2MjQyMDI2NjQsImlzcyI6InB1Yi0xNjAxNSIsInN1YiI6InBvc3QtcmVhY3Rpb24ifQ.dDchp84ZUeGS7R1QOxqfq From] [[Bankless DAO (BANK)|Bankless]] (17-6-2021):
* [https://newsletter.banklesshq.com/p/is-convex-the-yfi-killer?token=eyJ1c2VyX2lkIjoxMzk3OTAwLCJwb3N0X2lkIjozNzY3NjI2MSwiXyI6IitrN3VtIiwiaWF0IjoxNjI0MTk5MDY0LCJleHAiOjE2MjQyMDI2NjQsImlzcyI6InB1Yi0xNjAxNSIsInN1YiI6InBvc3QtcmVhY3Rpb24ifQ.dDchp84ZUeGS7R1QOxqfq From] [[Bankless DAO (BANK)|Bankless]] (17-6-2021):

Revision as of 06:33, 11 April 2022

Basics

History

"Convex is “supported by Curve” (see footer of Convex website), meaning some of the Curve developers invested in the project and helped them with the code."

Audits & Exploits

  • There is no evident bug bounty program (14-6-2021).
  • Got a score of 46% on DeFi Safety (14-6-2021): "MixBytes did a Convex Finance audit on April 19th 2021. While the audit brought up some concerning aspects, all were fixed. Convex Finance was released May 17th 2021." With the comment: "Good audit but no software docs and minimal testing.  No real info on who controls the contracts."

Bugs/Exploits

"In late 2021, as part of a security audit for a client, OpenZeppelin conducted a security review of the Convex Finance protocol. As part of the audit, the Security Research Team uncovered a vulnerability that, if exploited by two of three anonymous multi-signature wallet (multisig) signers, would have given the Convex multisig direct control over Convex’s locked value—then approximately $15 billion. Convex documentation specifically stated such control was not possible. This vulnerability has since been patched by the Convex Team.

  • From Blockthreat (7-3-2022):

"Convex Finance redeployed its vlCVX contract after an unknown vulnerability was responsibly disclosed to the project."

Governance

Admin Key

"There is some admin control information present, but this information discusses the voting of the veCRV which is not relevant to Access Controls."

  • Seems to have been updated immediately after and now has a dedicated page explaining its multisig admin rights. It states that it can upgrade gauge types, the pool manager, can control the arbitrator vault, can change fees, can set treasury address, can vote, can shutdown/pause new deposits (while allowing users to withdraw all funds) and says it "does NOT have access to user funds in any way".

DAO

  • After Mochi Inu came out of nowhere and bought and locked a ton of CVX and with it, stirred a whole lot of pots, Convex holders got spooked over Mochi's influence (12-11-2021):

"They have launched a proposal to basically disable the voting power of $MOCHI convex tokens. Main argument being that the $CVX was ill acquired and it would stop @MochiDeFi from taking any more disguised actions. Interestingly, even @ConvexFinance asks if them voting for this defies the very ethos of defi. It’s still early but currently the vote is 70%+ for disabling the voting power of $mochi."

Treasury

Token

Launch

Token Allocation

  • From the docs (6-2021):
  1. Max Supply: 100 million
  2. 50% Curve LP rewards Rewarded pro-rata for CRV received on Convex
  3. 25% Liquidity mining Distributed over 4 years. (Incentive programs, currently CVX/ETH and cvxCRV/CRV)
  4. 9.7% Treasury Vested over 1 year. Used for future incentives or other community driven activities
  5. 1% veCRV holders Instantly claimable airdrop
  6. 1% veCRV holders who vote to whitelist Convex Instantly claimable airdrop
  7. 3.3% Investors Vested over 1 year. 100% of investment funds used to pre-seed boost and locked forever(no cvxCRV minted).
  8. 10% Convex Team Vested over 1 year

Utility

"$CVX stakers get 5% of the yield generated. Users are receiving $CVX tokens - fair launch. LPs who keep their $CVX will be essentially paying fees to themselves."

Other Details

Stablecoin

Coin Distribution

Technology

  • Whitepaper can be found [insert here].
  • Code can be viewed [insert here].

Implementations

How it works

"Convex can provide boosted yield because it owns a large amount of $veCRV. How so? Convex allows $CRV holders to convert their $CRV to $cvxCRV. $cvxCRV is tokenized $veCRV. $cvxCRV holders receive a portion of the yield that stablecoin LPs generated (currently 138% APY)."

Staking

"Users can stake cvxCRV to earn Curve trading fees, boosted CRV rewards, paid out using earnings from LP vaults performance fee (10% of the total CRV earned), along with CVX rewards. CVX can also be staked on the platform, earning users more cvxCRV."

Liquidity Mining

Scaling

Interoperability

Other Details

Oracle Method

Privacy Method

Compliance

Their Other Projects

Upgrades

Roadmap

  • Can be found [Insert link here].

Usage

  • Reached $1bn in TVL (14-6-2021). It had $2.2m in revenue after 2 weeks (1-6-2021).
  • From this thread (1-6-2021):

"Owning $cvxCRV is so damn juicy that 18.2m $CRV have been irreversibly locked up in just 2 weeks. For comparison, Yearn has locked up 17.3m $CRV after ~1 year. Convex crushed Yearn's moat in 2 weeks. It now owns more $veCRV than Yearn."

"Despite launching under a month ago, the project has exploded in popularity, already attracting over $3.4 billion in TVL.

A considerable portion of Convex’s TVL comes from Yearn, as 33 of Yearns Curve LP vaults are utilizing strategies that involve depositing capital into Convex. In fact, Yearn is currently earning over 20% of the total CVX rewards that have been paid out."

"It took just 2 days for Convex to overtake Stake DAO, and 14 days for them to overtake Yearn."

Projects that use or built on it

  • StakeDAO; from Rekt (8-7-2021): "Instead of using their veCRV to boost their own vaults, Stake DAO has conceded the fight and migrated their Curve pools to operate on top of Convex. This move allows them to provide a higher APY than Yearn at present, but may be regrettable in the future, as it gives up more power to the already strong Convex platform."

Competition

"There are three key differences between Convex and Yearn:

  1. On Convex, users will have to manually reinvest their rewards back into the different vaults to compound rather than it being done automatically on Yearn
  2. Convex has a lower fee structure, as they keep 16% of profits in the form of a performance fee, while Yearn charges a 2% management fee along with 20% of profits
  3. On Convex, users can farm CVX (which can also be reinvested back into the various vaults)

Like Yearn, it provides similar increases in capital efficiency, yield, and liquidity for LPs and CRV holders, with the added benefit of additional CVX rewards."

Pros and Cons

Pros

Cons

Team, Funding, Partners

Team

"Convex is “supported by Curve” (see footer of Convex website), meaning some of the Curve developers invested in the project and helped them with the code."

Funding

Partners

(:

Knowledge empowers all and will help us get closer to the decentralised world we all want to live in!

Making these free wiki pages is fun but takes a lot of effort and time.

If you have enjoyed reading, tips are appreciated :) This will help us to keep expanding this archive of information.

ETH tip address: 0x83460bE5F218b1520B69D702cE60A1DE37dD8E31

Also check out CoinTr.ee for more content.