Yesterday (April 18, 2022) around 12:00 UTC due to an error related to the calculation of the reward for farming 4 users mistakenly received an overestimated number of EGG tokens.
The main issue is already resolved, but we’re still in the process of full resolution. In this article, I will explain what actually happened, how we acted during the incident, and what we’re going to do to avoid such scenarios in the future.
Before we start talking about the incident itself I have to describe how farming works in WavesDucks.
Ducks’ farming parameters depend on the rarity and total farming power of all staked ducks.
Every duck has 4 important numbers which should be combined with 2 global numbers (called currentInterest and farmingPower) to calculate how much EGG can be claimed from a duck at the moment:
farmingPowerlastCheckInterestlastCheckFarmedAmountwithdrawnAmountA number of EGGs to claim determined as following:
$$ lastCheckFarmedAmount - withdrawnAmount + (currentInterest - lastCheckInterest) * farmingPower $$
<aside> 🖇️ For those who are interested in all tech details – please see the smart contract code here.
</aside>
All duck numbers and global values are subject to change when ducks are staked/unstaked and when ducks rarity drop. Due to RIDE and Waves blockchain limitations, it is not possible to update all values on-chain right in the contract, so every night an oracle runs that updates values for ducks using data transactions. Here are examples of such transactions –
Another important note for this story – we have development contracts and ducks which are used only by the development team and have no value. The number of ducks for the environment is way less, the number of ducks on perches is less than 20, so farming numbers are different, and rewards are way higher (100-300 times) than in the production.
<aside> ⚠️ Yesterday, during the testing process of new upcoming items usage an oracle was run by one of core developers with the test environment values, but production keys.
</aside>
Corrupted data was deployed by the following transactions: