Chainflip Plans to Restart With Tron Paused and Provider Balances Reset

Chainflip plans to turn its cross-chain swap network back on with one route missing and its Tron liquidity providers holding a claim instead of a balance. Chainflip said an attacker took 736,442.17 USDT from its Tron vault on Sept. 12, leaving the vault unable to cover what those providers are owed. Its own posts are the only first-hand account of the attack.

“The Tron vault now holds far less USDT than LPs are owed, so those LP balances will need to be reset,” Chainflip said in a Sept. 15 post. At restart it closes every open order, strategy and lending position tied to Tron USDT, copies what each provider held into “a separate on-chain balance so the amount each LP is owed stays tracked” and sets the live account to nothing. “For LPs, your account will now read 0 for trxUSDT,” the post said, using the protocol’s ticker for USDT on Tron.

The separate balance records what each provider is owed; it does not pay it. Chainflip said it has “plans to deal with the shortfall,” is dealing with affected providers directly and intends to make them whole. It has not publicly said where the money comes from, when it arrives, or how much of the stolen USDT it expects to recover.

Version 2.2.13 of the protocol’s software, published Sept. 15, carries the settlement as changelog entries, down to taking providers’ balances “into a snapshot.” The same release restricts Tron vault swaps to “direct transfers to the Vault.”

That restriction is the fix. On Tron, Chainflip said, a memo carried on an incoming transaction is what tells the protocol to run a swap. The attacker had been able to attach one to a fetch transaction, an internal transfer its own validators had already signed, which its witnessing layer read as a failed swap and refunded on top of the attacker’s own LP withdrawal. A memo now registers only on a plain TRX transfer or a direct TRC-20 transfer. Anyone sending from a smart contract wallet, and any aggregator whose transfers arrive wrapped in its own contract call, loses easy access to Tron vault swaps as a result, though Chainflip said none of its current integrations work that way.

Chainflip said a user swap of 115,654.41 USDT is still sitting in the vault, payable once the network is back, and Chainflip said every other chain returns at restart with Tron off until its witnessing layer catches up. It disclosed the exploit itself the next day, in a Sept. 13 incident report that said all other funds were “unaffected and secure” and called the episode “the first significant critical security event resulting in the loss of funds from Chainflip vaults.” Blockaid counted a record 212 exploits in the first half of this year, before this one.

Related Listen: OpenAI Says It Cracked a Millennium Prize Problem. Why Is Anthropic Hitting the Brakes?

{"@context":"http:\/\/schema.org\/","@id":"https:\/\/unchainedcrypto.com\/chainflip-plans-to-restart-with-tron-paused-and-provider-balances-reset\/#arve-youtube-pnogg0vejjs","@type":"VideoObject","embedURL":"https:\/\/www.youtube-nocookie.com\/embed\/pNogg0vEjjs?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=1&autoplay=0"}

The post Chainflip Plans to Restart With Tron Paused and Provider Balances Reset appeared first on Unchained.