A community-driven response to Velar's recent exploit

Yesterday, the Mezo dev team shared their post-mortem of Velar’s recent exploit, impacting their dApp on the Stacks and Mezo chains.

Velar’s PerpDEX exploited on Mezo

On February 19, the Mezo security team was made aware of a drain on the Velar BTC/MUSD perpetual swap pool on Mezo by one of the primary participants, the curator of the Upshift tBTC vault. Though no one working directly on Mezo is responsible for operations of the Upshift

Mezo: Everyday Bitcoin FinanceAntonio Salazar Cardozo

The timeline of the exploit was unfortunate. Because of the late notification of the loss, there was no time for validators to pause the bridge or otherwise slow the movement of stolen funds.

Coordinating a community-driven recovery

At the Supernormal Foundation, we know that security in DeFi is difficult - and we’re doing everything we can to support impacted users and our ecosystem, including looping in SEAL 911 and encouraging the Velar team to collaborate with law enforcement to assist funds recovery.

But how might we come together as a community to do more?

Introducing REKT

To better coordinate the recovery across the community, we’re launching REKT, an airdrop for impacted depositors. 401,300 REKT will be minted and airdropped to those impacted by the Velar incident on Mezo, alongside the launch of a small REKT/MUSD pool.

Why?

• As a community, we can achieve more, together.
• Velar and any other interested parties will now have a decentralized way to make help depositors whole, if they so choose, on their own timeline. By buying and burning REKT, they can return value to impacted depositors over time.
• As the fund recovery effort progresses, funds can be used to buy and burn REKT, avoiding additional coordination across the 87 impacted wallets.
• In fact, any user can now help the recovery effort by buying REKT on the open market, and once MEZO launches, veBTC voters can donate their voting power to the MUSD/REKT pool, helping speed up the recovery effort.

What does this mean for impacted Upshift depositors? It means they can decide to sell their REKT immediately, taking the loss, or hold out for recovered funds.

To kick things off, the Thesis team has agreed to seed the REKT/MUSD pool with $50k in liquidity and kickstart the recovery process.

Next steps for Upshift depositors

Affected users should ensure they have a Mezo ID that matches their EVM wallet used to deposit on the Upshift tBTC vault. This is where they will receive the REKT airdrop.We will create the REKT token and pool on the Mezo DEX, which will subsequently be seeded by Thesis with 25,000 REKT and 25,000 MUSD.

Affected users can then either use the pool to sell their REKT tokens for immediate liquidity or deposit their tokens in the pool, stake the LP token, and receive MEZO emissions. After TGE, we encourage veBTC holders to vote and direct emissions to the REKT/MUSD pool, supporting impacted Upshift depositors.