BondingV2 Migration Update 2

Bonding V2 Update

by Λ L Ξ X / アレクサンダー.eth
"Ship it!"
"Ship it!"
We are having delays due to UBQ rewards having had gone off the rails.

The Discovery

Zgo & Zapaz (DeFi veterans) wrapped up the BondingV2 smart contract while Zequez (our latest engineering hire and also new to DeFi!) handled the frontend changes in parallel.
Zgo, myself, and 3commascapital (all devs) jumped in with the migration from v1 → v2 to test drive the new UI. During the initial testing we ran into several issues, including but not limited to this:
We accidentally created a scamcoin zillion percent APY farm ??
We accidentally created a scamcoin zillion percent APY farm ??
At this point, we were quite certain it was the new hire who made a mistake with the calculations. After personally looking through the UI code; the horror dawned on me. The UI code was all correct. Immediately afterward, I queried the smart contract directly.
Our Solidity goose has been cooked.
Our Solidity goose has been cooked.
And thus began the wild goose chase with the uAD protocol team.

Cliff Diving

The first action taken was that we disabled the rewards emissions for BondingV2 in case anybody else figured what happened at the same time as us. Next, the team went spelunking deep into the Solidity source code and speculated an uint underflow...
notion image
The underflow hypothesis was less favored over the realization of the use of different precisions for the division.
notion image
Zgo was eventually able to inspect more closely and identify what likely is causing the issue:
notion image
Soon after, a pull request (a proposed fix) was made.

Entering the Matrix

notion image
With Zgo's new code in place, Zapaz was able to run the simulations:
notion image

Current Status

  • The product team has identified the issue, created a fix, and is running additional simulations to ensure that the pending rewards behave as expected.
  • The community's LP tokens are safe and unaffected in BondingV1 because the BondingV2 system is not connected to V1. No funds are at risk.
    • Even if you migrated to BondingV2, we will simply handle moving you over to BondingV2.1 (we would prefer that others do not migrate just yet though!)
  • The expected completion date of BondingV2.1 is anywhere between Friday, 6 August - Monday, 9 August depending on the results of the simulations.
What about the ~5 quintillion pending UBQ Rewards?
Fortunately, the three devs with access to 99.9999% of the UBQ supply have the best interests of Ubiquity in mind. The plan is to nuke the claim-ability of these (or claim and burn, whichever is easier and verifiable) at the end of this migration process.

What About The Future?

After this is situated I plan to have a proper debriefing with the smart contracts team to evolve our engineering processes to mitigate something like this from happening again in the future. Fortunately, we still have a small community and relatively smaller stakes. This allows us the luxury to work out any operational kinks before we become…Ubiquitous.

Calling DeFi Investigative Journalists

There are many stories that never see the light of day from behind-the-scenes of protocol research and development at Ubiquity. We’d love to change that. If you’re into stable coins, writing, and uncovering the truth please reach out to us! We’d love to have you join our team!
As always, if you have questions and concerns, Discord is where it's at.