Iron Finance vFarms incident Post-mortem (16 March 2021)

The Incident

Two Iron Finance vFarm pools were recently subject to an incident that resulted in the loss of user deposits. On 16 March 2020 at 10:20 am UTC, the following two vFarms were exploited:

1. 50% IRON — 50% SIL
2. 50% IRON — 50% BUSD

A user who farmed in these two pools, claimed all SIL rewards allocated for farming over the next 12 months and made a profit of around $170k by selling SIL for BUSD on vSwap. Please see below the official announcement on behalf of Value DeFi explaining what caused the incident.

Proposed Changes

We take responsibility for the incident and propose the following steps:

1. Roll the new token SIL-v2 with the ticker sIRON. We will update everything on the UI and elsewhere to sIRON. We will need less than 24 hours to perform this update. Please do not buy any current SIL tokens (“SIL-v1”) anymore.
2. Re-create the pool:SILv2-BNB only (only one pool is needed at first)
3. Re-create vFarm for IRON-BUSD and IRON-vDOLLAR
4. Create a google form or similar form where people can submit their claim of loss with their affected BEP20 address. The Iron Finance team will manually analyze the details of each claim to see what the exact amount of losses were for each particular address.
5. Once step 4 is done, we will provide detailed information on the compensation plan. Please follow our social media for detailed updates.

IMPORTANT NOTICE TO IRON HOLDERS: Please don’t sell or redeem your IRON right now. We will have a new pool tomorrow, so if you want to redeem, you will get the full amount of BUSD back.

We greatly regret this incident and sincerely apologize to all affected users.

Website: https://iron.finance
Twitter: https://twitter.com/IronFinance
Telegram: https://t.me/ironfinance
Medium: https://ironfinance.medium.com
Docs: https://docs.iron.finance