On April 9th, 10 PM UTC, suspicious trading activity was identified involving a trader or group of traders on Buffer Finance's decentralized options trading platform.

The trader(s) used five different wallets, achieving unusual win streaks and high win rates across both ARB and USDC BLP pools.

Below, we provide a detailed timeline of events, root cause analysis, impact, mitigation, LP compensation plan, and the road to long-term sustainability.

Timeline of events

Cycle 1:
Starting 01:12:28 Apr 9, 2023, UTC, a trader placed consecutive trades on the BTC/USD pair on the uBLP pool using the following wallet A (0xA506565E7D1330F172ba41AAF90b840C47a0b822)

The trader also simultaneously executed trades on the BTC/USD pair on the aBLP pool using a second wallet B (0x38126B14Fb81C50b58a00eBFD8376F5E3dE82438)

Cycle 2:
At around 03:27:17 Apr 9, 2023, UTC, the trader started placing trades on the BTC/USD pair on the aBLP pool using 2 new wallets C & D (0x7D74C85dF27fc42142aDA6a238411727Ee5572E0) and wallet (0xF5996Dd3eFC0bA3cF664209Db59E441c34758dE7)

He continued a similar streak on the BTC/USD pair on the uBLP pool, using wallet E (0xf0344CC4E0c0b5E653A83E4E2c9CB198Cb8bF60D)

• Win rate analysis: Wallet A (81.81%), Wallet B (91.17%), Wallet C (87.50%), Wallet D (92.30%), Wallet E (87.50%)

BLP (ARB/USDC) Liquidity Providers Compensation

To make (aBLP/uBLP) holders who were affected by the toxic trader activity on April 9th, 2023, whole:

- a total of 35,196.9134 USDC will be airdropped across 470 wallets

- a total of 41,698.10 ARB will be airdropped across 445 wallets

Find the complete list of wallet addresses and corresponding ARB/USDC distribution: Here.

The exact date for airdrops will be shared in the coming week via official channels.

We acknowledge the delay in announcing the compensation plans. However, it was more important for us to deliver a thorough and accurate analysis of all losses to make sure all affected users were accounted for. At the same time, the risk mitigation measures mentioned in action had to be implemented simultaneously.

Mitigation:

• Changed minimum trade timeframes to 15 minutes (although the issue was not directly associated with shorter timeframes, this change was implemented based on community feedback)

• Implemented auto-cut-off (temporarily halting trading if both USDC or ARB lose more than 5,000 USD).

During the event team’s reaction could have been more instinctive. We acknowledge that, and however, implementing changes that directly affect the platform’s operations/parameters cannot be taken lightly.

It’s key to pace ourselves and conduct a thorough analysis instead of rushing to meet timelines.

Root cause analysis Our team compared our price feeds with other exchanges. It was noted that multiple sudden spikes in price lasted long enough for the trading bot to take advantage of the anomaly. A sudden spike in price cause an unusual wick which typically occurs when liquidity is scarce, and trading activity on the platform is limited, influencing the information utilized by the oracle.

These spikes were captured by a bot that had already subscribed to our price feed via a web socket. The bot placed a trade during this timeframe, knowing that the price would revert back to the normal range.

Typically MM (market-making) bots continuously stream quotes to move the short deviation back into range. However, some of these quotes get staled or pulled out, resulting in a spread increase.

Our analysis suggests that the malicious bot took advantage of a situation where many MM bots were not running and the quotes were stale.

Mitigating Future Events

A detailed report on how we are building towards a more robust Buffer has already been released to the community. Read HERE.

Here’s a TL;DR version of the same:

Note that these are measure dynamic, subject to fine-tuning as the protocol evolves.

Pyth Network powering trading on Buffer:

• Pyth Network has been integrated as the primary low-latency oracle solution on Buffer Finance.

• Granular market data, access to price feeds for a larger number of trading pairs

• Thanks to Pyth integration, Forex trading on EUR/USD and GBP/USD pairs is live

• We will undergo a complete contract integration with Pyth Network for Buffer V3.

• We are also currently exploring more avenues to strengthen our Oracle system, including Chainlink’s low-latency Oracle as a fallback mechanism.

2 Tier Pool System:

• On top of aBLP and uBLP pools, we have introduced a 3rd POL-based pool. POL seeded at 10,000 USDC

• Will act as a counterparty for smaller trade sizes starting with 5 USD. - 100 USD.

  aBLP/uBLP pool update:

The minimum timeframe of 3 mins has been re-activated on both pools Smaller trade size will be back as the pool recovers and OI grows

Payouts:
The payout structure has been re-aligned with the risk management of Buffer v2.

Base payout for all pairs set up to 70%

NFT payout boost decreased to create parity between trader rewards and LP risk management.

We’re grateful to everyone who shared their feedback and helped Buffer emerge from this incident 💪 stronger. We look forward to discussing these ideas and announcing new features to strengthen the platform's growth.

Stay tuned for more announcements on Buffer V3 and upcoming releases.