MetalSwap

What a day, Swappers!Big news are coming to the official MetalSwap infrastucture! The changes will lead to the Second Version of the Hedging Swap service: with a rebranding of the whole frontend, logo and related NFT appearance (gotta deploy a new NFT descriptor!), together with new Smart Contracts and new Liquidity Pools! What a package of news!The graphical enhancements will come soon, and with a dedicated Medium we will delve into the frontend topic.Today we wish to dive-in all about how the Development Team works and the technical reasons that make us to take the decision of changing the <a href="https://medium.com/metalswap/certik-s-audit-100-fe7102776126" rel="noopener noreferrer nofollow">already audited</a> Smart Contracts on MetalSwap ‘s main service: the Hedging Swap tool.<h2 id="header-0">Backend Workflow</h2>As you already know, security is of paramount importance for MetalSwap.That’s why our devs stress-tested their Smart Contracts in a lot of ways since the beginning of MetalSwap ‘s dApp history with:- Testnet (Kovan &amp; Goerli)- First internal Audit- Audit by external entity: <a href="https://medium.com/metalswap/certik-s-audit-100-fe7102776126" rel="noopener noreferrer nofollow">Certik</a>- Protocol activity monitor (always live)- Swap Competition- Second internal AuditMetalSwap ‘s first ‘Bug Bounty Program’ is also about to officially start (…ops! That was an alpha!)After <a href="https://medium.com/metalswap/certik-s-audit-100-fe7102776126" rel="noopener noreferrer nofollow">Certik ‘s Audit</a>, we deployed the audited Smart Contracts on ETH mainchain to create the first version of the Hedging Swap Tool.We decided momentarily, for security reasons, not to incentivise the Liquidity Providing, so as to let people start using our instrument with the liquidity provided mainly by the Foundation. Namely, MetalSwap is assuming all risks on the security side if something goes wrong on Liquidity Providing ‘s side.<h2 id="header-1">The Audited Issue</h2>Anyway, that not-so-incentivised Liquidity Providing had a small $XMT Reward generated from the Liquidity Reward system. Claiming that Reward, we discovered an unexpected bug involving <a href="https://ethereum.org/en/developers/docs/mev/" rel="noopener noreferrer nofollow">MEV mechanisms</a>: that Liquidity Reward, owned by the Liquidity Provider has been front-runned by an Anonimous player with the following address, than bridged to BNBChain 237.140 $XMT: <a href="https://bscscan.com/address/0xD542AA8F1789edf123AD816C1b59eD9FeD15C50e#tokentxns" rel="noopener noreferrer nofollow">Link</a>Another address involved is <a href="https://bscscan.com/address/0x7561250228a7b98d638fb810fb3507433ae1c5b0#tokentxns" rel="noopener noreferrer nofollow">this</a>: after the bridging, it swapped 26.449,24 $XMT for 420 $BUSD.The 0,013177% of the Total of $XMT supply has been in control of these unknown addresses.Note: the given liquidity has not been affected by the issue. That concerns only the little Reward in $XMT that goes to anyone is providing liquidity.Anyway, the amount lost can be easily covered with Foundation ‘s funds.Three other NFT small Liquidity positions were minted beyond the Foundation by some users curious to understand the mechanism, and their Liquidity Reward dried up by our infamous player.We’re sending the corresponding $XMT Liquidity Reward value to them.The main interest for MetalSwap ‘s team is to preserve the governance, that’s why we invite our drainer to give back the 237.140 $XMT to 0x12829fa551E3218E984286a09DA38Aa59c73125E to get back $USDT at spot prices.<h2 id="header-2">Discovered the issue, deployed the mitigation!</h2>From now on, LP providing is no longer incentivised with any kind of Rewards. NFTs of Liquidity Provided will have to be withdrawn from the legacy frontend because they will no longer receive any incentive and the Rewards accumulated to date will be awarded automatically.Anyone willing to recreate their positions, it must be done in the next version of MetalSwap ‘s dApp, involving new Smart Contracts that are including some tweaks and an update solving completely this “Rewards Frontrun” bug.$XMT rewards accumulated up to this point will be received directly to the corresponding Liquidity Provider addresses.This “second internal audit” has been so helpful, and after <a href="https://medium.com/metalswap/certik-s-audit-100-fe7102776126" rel="noopener noreferrer nofollow">Certik’s OK</a> we thank our Dev team for always keep both eyes on the Security topic, and also for the readiness to make it solved.Now it’s time to act and deploy a new version of MetalSwap ‘s SmartContracts, also updating the Liquidity Providing NFT Descriptor to see the new logo (spoiler <a href="https://youtu.be/3pRSrqG9mrI?t&#61;3549" rel="noopener noreferrer nofollow">here</a>, during the XMT1Y event)!We’ll call it…<h2 id="header-3">⚡V2!</h2>Version 2 of the Hedging Swap Smart Contracts is now deployed on the ETH mainchain, it will be Live in MetalSwap’s dApp within the next 48 hours at the official address of <a href="https://app.metalswap.finance/" rel="noopener noreferrer nofollow">https://app.metalswap.finance</a> All active Swaps still in V1 will be visible and manageable via this address: LegacyV1LINK &lt;- updates coming soonIt will not be possible to Open new Swaps on V1 anymore. Every New Hedging Swap order will be Open on V2 (with lower fees!), right after its Official deployment on MetalSwap ‘s frontend.<h2 id="header-4">Swap Competition</h2>From this moment, no new Swaps are allowed to be Open; only the V1 still-Active Swaps that are closing before the 12 dec 23:59 GMT are still elegible for the TOP30. Next competition will take place in V2.<h2 id="header-5">New Contract Addresses</h2>The newest Smart Contract addresses will be pointed out here below, together with the corresponding docs section.If someone is working on alternative frontends, point them to the new Smart Contracts!Many more news are coming very soon, stay clear!What a time to be in DeFi!⚠️️Warning⚠️❗ METALSWAP ‘s admins or moderators will NEVER contact you directly on any social under any kind of circumstances.❗ Everything concerning $XMT ‘s smart contracts and addresses is shared by our official channels (list below), do not trust any different info from any different source.To the MetalSwap!… and beyond-The Defi Foundation

NEW LIQUIDITY POOLS: V2 ON THE WAY

Table of Contents

MetalSwap

Other articles published on Dec 6, 2022

Bloomberg Reposts Anti-BTC News On El Salvador 11 Times in 30 Days

24 Hrs Crypto Update, Dec 2: Global Crypto Market Became Highly Unstable

Founder of Eight Global States: Altcoins Are Showing Strength

Voting for the future of Lean Management Token

Philippine Blockchain Week hosts key industry experts, venture capitalists, and startups with Alt...

Enjin Development Update (6/12/22)

Join our free newsletter for daily crypto updates!