If you have not read the post-mortem, a Concentric developer was social engineered to download a piece of software that contained malware that allowed the counterparty to access our deployer keys, upgrade the vault implementations and mint vault tokens to burn and withdraw the funds in our vault contracts. It was suggested in our contract audits to convert the deployer to a multi-sig. We acknowledged this comment but unfortunately did not fast-track its development. We now see this was a mistake.

$CONE and $xCONE:

Since the hacker now has access to the deployer wallet, they were able to withdraw the remaining xCONE in the deployer that was going to be used for emissions. Due to this circumstance, to prevent them from converting their xCONE and selling into the remaining liquidity on Camelot, we have decided to sunset the $CONE token. As the team was already thinking about a v2 for $CONE with a higher degree of tokenomics, this is in the best interest of all parties. To sunset $CONE, we will be taking the following steps for token holders:

1. Withdraw remaining CONE-USDC liquidity

2. We will take a snapshot of all CONE, xCONE, and xCONE vesting balances.

3. We will post these balances in a spreadsheet, and allow a 1 week dispute period.

4. We will use the remaining USDC in the liquidity pool to set up a claim contract, where CONE, xCONE and vesting holders can redeem their USDC, and we will blacklist any addresses affiliated with the security breach and team addresses from redemption.

More details will come soon, including the price per token and total USDC in the redemption pool. At the time of this, there are 91141.640823 CONE, 118,128.73 xCONE and 51,665 vesting tokens eligible for redemption. With 120,709.98 USDC remaining in the CONE-USDC LP, each user will be able to claim 0.457 USDC per CONE, xCONE or vesting balance. We will give a 30 day window for users to claim from the contract, and the remaining funds will be allocated to the LP remediation pool.

Liquidity Provider Remediation:

As we continue to work with authorities and relevant industry professionals to track down the funds and return them to LP’s, we will outline this plan below to begin a remediation process. At the time of writing this, the protocol holds about $25,000 in treasury funds and 0 TVL. While we understand getting capital back into hands will be a long process, we will continue to work on the protocol, launch new products, and rebuild the trust we damaged in the process.

1. A snapshot will be taken for all LP balances and converted to dollar value prior to vaults being drained of funds.

2. Each individual user will receive a transferable ERC-20 token corresponding to their dollar denominated vault deposits.This means If you had $1,000 deposited into WETH-USDC, you will receive 1,000 “coneLP” tokens. There are two main objectives to this. As we are sunsetting both CONE and xCONE, 50% of all forward fees will be allocated to this new token, which will accrue these fees indefinitely, meaning even when LP’s are fully reimbursed, they will continue to earn protocol revenue. Making the ERC-20 transferable allows Concentric to use a further portion of fees to start re-purchasing and burning these tokens by offering OTC purchases on Pintswap for $1 each, equal to the raw value of their deposited liquidity. Users, if they wish to sell their Concentric LP debt, may also transact with each other for this ERC-20. This version of the ERC-20 will never be minted again, and as we continue to buy back this token and reimburse LP’s at face value for their deposits, remaining holders will see an increase in overall yield for their own share.

Future Protocol Development:

With $1.7M to work towards reimbursing and $25,000 in assets, the team will continue to develop new products and strategies in the decentralized market making space. Concentric also lost $30,000 in our vaults, as we were anchoring a few lower TVL pools, which consumed over 50% of our assets at the time, and is not nearly enough to make a dent in the remediation process. As a team, we will not give up on our initial vision for the protocol, and still plan to build out all of the products and advancement we were previously working on, and believe the protocol still has a bright future ahead. Below, we would still like to outline our plans beyond beginning the remediation process and sunsetting the token.

1. The team will re-architect some of the backend infrastructure, including fixing any previous comments on our audit that we acknowledged and pose a threat to capital preservation. The front-end is not compromised, and we will continue to use the same website for future products.

2. Once we have created a new deployer contract, we will first work on the CONE claim contract from splitting our LP, and give ample time for CONE, xCONE, and vesting holders to claim their USDC. We will post the spreadsheet of balances in advance of this, allowing a dispute timeframe before finalizing the claim shares.

3. We will post a second spreadsheet with all LP balances in dollar amounts and coneLP distributions, which will then be airdropped to vault depositors affected by recent events.

4. Once 2 and 3 are completed, we will start to slowly re-launch vaults with complete automation, and a flat 75/25 performance fee. As mentioned previously, LP’s will be able to claim their fees directly on the front-end, instead of compounding fees back into the contracts. The 25% performance fee will be allocated as such: 10% will go to coneLP holders indefinitely, meaning we will never sunset the token, and fees will continuously be allocated through these contracts from all future Concentric products. 5% will be used to re-purchase coneLP tokens through Pintswap. We will offer bids on a regular basis, both reducing the supply of coneLP tokens, and raising APR for those who wish to continue receiving future protocol revenue. 10% will be used to replenish the treasury, paying for protocol development, any future audits, and 3rd party services for marketing and account management.

Overview of the Incident

Concentric experienced a significant security breach stemming from a social engineering attack. This incident severely compromised our operational integrity and led to a considerable financial loss, deeply affecting our community's trust and the overall stability of our protocol.

Initial Breach and Attack Methodology

The breach originated with a targeted social engineering attack against a team member, with access to the deployer wallet. The attacker, posing as a recruiter on a professional networking platform, skillfully gained the trust of our team member. This led to the installation of malware under the guise of a routine skill assessment, which compromised the team member’s computer and, critically, the private keys of the deployer wallet.

Exploitation and Impact

Having obtained access to the deployer wallet, the attacker executed a series of calculated actions:

• Transfer of Contract Ownership: The attacker shifted the ownership of the ConeCamelotFactory, a vital contract in our ecosystem, from its original address to a new, attacker-controlled address.https://arbiscan.io/tx/0xd9036566a2614045219e9bead34e490fc24c9d6ca695d5348b694c3280558e3b

• Upgrading the Vaults: Utilizing their newfound control, the attacker upgraded the existing vaults’ implementation to a new contract. This new contract was embedded with an admin mint function.https://arbiscan.io/tx/0xb2fa31c9bc7d5e41955cb81224545588c1a0746b8564f14a2e143dc56364020a

• Minting and Draining: The admin mint function was then exploited to mint new LP tokens illegitimately. This action allowed the attacker to drain the assets from the vaults effectively.New owner: https://arbiscan.io/address/0x105f52fcc329cef4cbe25bc946f8a3738414e4a1

Financial Loss and Transaction Details

The attacker drained a total of 715.7 ETH worth of assets, equating to approximately $1.7 million, from our vaults. The initial drainage occurred through this address:https://arbiscan.io/address/0x105f52fcc329cef4cbe25bc946f8a3738414e4a1

Subsequently, the funds were distributed among three different wallets:

https://arbiscan.io/address/0xfd681a9aa555391ef772c53144db8404aec76030

https://arbiscan.io/address/0x1f14e38666cdd8e8975f9acc09e24e9a28fbc42d (Tagged OKX Exploiter 2)

https://arbiscan.io/address/0x17865c33e40814d691663bc292b2f77000f94c34

Efforts for Fund Recovery and Security Enhancement

In light of the recent breach, our team at Concentric is fully committed to recovering the stolen funds. Recognizing the complexity and sophistication of this attack, we have sought the expertise and counsel of several top-tier security experts and they are assisting us in tracing the stolen assets and exploring all possible avenues for their recovery. In addition, we are leveraging blockchain analytics to track the movement of the stolen funds and have contacted top exchanges like Binance, OKX and others to flag the exploiters’ addresses.

We’re working with the relevant authorities and we’re announcing a 100k reward pool for any information that could lead to the recovery of the funds. If you have any information, any lead that could help us in this situation, please reach out. Your insight could be the key to recovering the funds and safeguarding others in our community. We assure you that your help will be valued and your privacy respected.

A simple fact that everyone knows, but few people understand: LP’ing your tokens is easy, but doing it correctly is very difficult.  Anyone can make a deposit to Uniswap or Camelot, but without constant management, you’re actually leaving a ton of yield on the table.  What if we told you that with a better strategy, your APY could be double or even triple what you’re currently earning?

This is exactly why Concentric is introducing its flagship product: zero effort vaults for maximum LP yield.  Deposit your tokens into the protocol, set it, and forget it.

Recently, we posted on Mirror to introduce Concentric and describe some of the inner workings of the protocol.  Today, we’ll go over how the vaults themselves work, so you have a better understanding of protocol design. Let’s dig in.

Concentrated Liquidity: Pluses and Minuses

By now, most people are familiar with Uniswap’s concentrated liquidity model. Using their v3 model, you can choose a price range for a given token pair, and your LP position will only be active when price falls inside that range.  Parameters can be modified to balance yield against risk, but there’s a bit of strategy involved.

Consider: if you keep your position within a very narrow range, you receive higher fees for LP’ing.  If it’s too narrow though, you risk having the price move out of range.  Then you’re not earning anything at all.

Here we have the central value prop of Concentric: keeping your liquidity in a range as narrow as possible without losing money to downtime.

How is this accomplished?  Three primary mechanisms:

1. Optimizing LP Range: The vaults use an algorithm to determine the optimal range size for your token pair.  This way, you earn the highest yield possible when in range.

2. Allocating Liquidity: Given that volatility will inevitably drive the price out of range sometimes, the protocol divides your position into three separate ranges, calculating the most effective width and allocating the ideal percentage of liquidity to each.

3. Recentering and Rebalancing: On a periodic basis, the protocol recenters positions around the current spot price, making it less likely for the price to go out of range.

Now let’s take a look at each of these and go into a bit more detail on how they work.

Optimizing LP Range

At the heart of the vaults is an algorithm that calculates optimal range.  It’s designed to find the perfect middle ground for an LP position - narrow enough for high yield, but wide enough that the price stays in range.  There are a number of factors involved in this calculation, but the thing it leans most heavily on is implied volatility - the market’s forecast for how much price movement it expects within a given timeframe.

If you look at the chart above, you can see that the 1-day IV is listed at 31.75.  Implied Volatility is equal to one standard deviation, so we can infer that most of the time, the price of ETH will spend the next 24 hours within a 31.75% range.

You can see where this is going: if the market predicts a given range of price volatility, the algorithm uses this to deduce the appropriate range for a liquidity position.  In the future, ranges will be dynamically adjusted based on underlying volume, allowing them to narrow in anticipation of future changes in volatility.  For now, however, they are static, and provide a good approximation of likely price movement within a given timeframe.

Maximizing Uptime

So it’s great that IV is used to open a position more likely to stay in range, but obviously this can’t work all the time.  Prices are unpredictable.  For this reason, Concentric vaults actually open three separate ranges at the same time, and divide your liquidity between them.

In the same way that the narrowest range is determined by the implied volatility on a 1-day timeframe, two more ranges are constructed using the 7-day and 30-day IV.  This way, even when the price goes out of one range, it remains in at least one other.  All three of them are centered around the current spot price, with each successive range wider than the last.  Hence the name: Concentric.

Now, due to the design of the v3 model, narrower ranges receive a higher percentage of swap fees.  By definition, however, ranges constructed around higher time frames will be wider.  The vaults account for this by determining how much each range will receive based on its width, and allocating liquidity in a way that they all receive similar yield.  This has the added benefit of assigning more liquidity to the wider ranges, allowing the LP to capitalize on slippage from large trades.  This ratio is one more part of the calculations that go into maximizing return for liquidity providers.

Recentering and Rebalancing

While we can set our widths in such a way that price is statistically likely to stay in range, price action will inevitably leave any range over a long enough time period.  In any kind of trending environment, the price will simply not be in the same place indefinitely, and changes will need to be made.

This brings us to the final mechanism we’ll cover today: recentering and rebalancing.

With recentering, as the price moves in one direction or the other, the vaults will automatically update your position so the range is centered on the current spot price.  Say the price of ETH is at $1675, and the 1-day range for our LP trades between $1625 and $1725.  If the price goes up to $1715 the next day, your position is now $10 from exiting the range and leaving your capital stranded and non-productive.

For this reason, positions are periodically refreshed with the current spot price at the center.  In this case, liquidity would be withdrawn and redeposited with a range between $1665 to $1765 - equidistant from the current spot price of $1715.  Newly calibrated in this way, the position is once again unlikely to exit the range before its next recentering.

Finally, there is rebalancing.  Any LP position is made up of two tokens, and the ratio of each changes as a result of price movement.  As the price of one token goes up, your LP accumulates more of the other one, leaving the position with a disproportionate weight.

To recenter a position around the current spot price, however, requires the tokens to be weighted equally.  To achieve this, a swap is made to ensure you have the same amount of each asset.  This rebalancing, a necessary prerequisite to reopening your LP position, occurs at the same time as recentering.

This important thing to know about rebalancing and recentering is that both are a critical part of LP management, and it’s simply not possible to maintain a productive LP position without doing them.  These transactions are time-consuming, however, and they consume quite a bit of gas.  Recentering for the 1-day range currently occurs every six hours - for the average retail user, to perform these transactions with this level of frequency would almost certainly cancel out all of the yield they received from LP’ing in the first place.

One of the major benefits of the Concentric vaults is that by pooling all of these LP positions together, these recentering transactions are batched and cost a tiny fraction of the total yield.  In a sense, it’s like a buyers’ club for liquidity providers - an economy of scale that becomes efficient through the sheer number of users.  This alone makes the vaults a more realistic solution for most than LP’ing independently.

So we’ve explained the three mechanisms that underlie the Concentric vaults.  Now, to tie it all together, let’s see an example of what’s going on behind the scenes.

Example

Take the spot price of ETH.  Currently, it sits at $1675, and the implied volatility on a 1-day timeframe is 31.75.  7-day IV sits at 28.87, and 30-day at 30.89.

As discussed above, these IV figures are factored into the calculations to determine three range widths:

Range 1: 4%

Range 2: 9.5%

Range 3: 35%

These widths give you upper and lower bounds for each, centered around the current spot price.  In real terms, this means:

Range 1: 1607 - 1741

Range 2: 1515 - 1833

Range 3: 1088 - 2260

Finally, because the v3 model pays more or less depending on how narrow your range is, different amounts must be allocated to each range.  Based on the vault’s calculations, these weightings are:

Range 1: 15%

Range 2: 37%

Range 3: 48%

Voila: three ranges calculated to bring in maximum yield with the maximum amount of uptime, with liquidity distributed to each in proportion to its size.

Remember, this is one example based on the current spot price and the IV figures for three different timeframes.  These numbers will all change though, and the range sizes will change with them.  As they do, the vaults will update the ranges, all while continuing to recenter and rebalance your position, saving you time and gas fees, and maximizing yield.

Conclusion

Hopefully this helped to explain exactly what’s going on under the hood with the new Concentric vaults.  LP’ing is one of the cornerstones of DeFi, and we want to make it profitable and accessible for all users.  We look forward to doing just that when the vaults launch in early October.

In the meantime, feel free to reach out with any questions or thoughts - we would love to hear your feedback!

Twitter

Medium

Discord

In theory, providing liquidity to Concentrated Liquidity Market Makers (CLMMs) is a great way to earn passive income - just deposit your tokens and watch the swap fees roll in. However, managing your liquidity position can be a hassle. That’s because when you deposit liquidity, you only earn fees when the price of the LP pair falls within a predefined range. If it goes outside that range, you don’t earn anything and your tokens sit idle.

Consider this example.  If you deposit into an ETH-USDC pool and you set your range from 1800 to 2000, you only earn fees when ETH is trading at a price of 1800-2000 USDC.  Anything other than that and you get nothing!  It seems like you’re either losing capital to impermanent loss, or losing time and gas to monitoring your position.  Isn’t there any alternative?

Introducing Concentric

This is where Concentric comes in. Instead of having to constantly monitor your LP positions, Concentric has created an extremely useful product that does it for you: our flagship product, Concentric Vaults.

Using these vaults, Concentric manages liquidity on AMMs like Uniswap v3 and Camelot v3 to produce optimal returns in a completely autonomous fashion.

So, how exactly does this work?

Once the app is live, you’ll be able to deposit assets into Concentric Vaults, and based on a set of customized factors, the Vaults manage these assets to earn the highest yield possible. These factors include things like the potential yield of an LP pool, underlying assets’ risk profile, and pool stability. In exchange for their deposit, users will receive spNFTs - essentially, receipt tokens that can be used in more advanced products on Camelot.

At first, all Vaults on Concentric will use Camelot V3 to manage assets, but the protocol is built to interact with any concentrated liquidity pool. So, you can bet that there will be expansion in the future in terms of assets as well as DEXs supported. There will also be many different strategies added to Concentric over time to fit all sorts of risk/reward profiles.

The Role of CONE and xCONE

Now, let’s get to the protocol’s token: CONE. CONE will primarily be used as an incentive token to reward users of Concentric, so if you deposit into a vault, you’ll earn CONE tokens as payment based on the amount of liquidity you provide.  The more assets you deposit, the more CONE you earn. As we’ll explain shortly, the amount of CONE tokens designated for emissions is 44%, so APYs will be pretty generous early on.

Users will also be able to stake their CONE for xCONE, unlocking an entirely new set of features. These include:

Real Yield: 50% of all vault fees are paid to stakers, which incentivizes people to lock up their CONE. xCONE utilizes RP or “Reward Points.” These function in a similar way to GMX and MP. The longer someone stakes, the more RP they will accrue, which will entitle them to a higher share of the staking pool. Concentric will issue 500,000 RP over 2 years, and recycle the RP from unstaking.

Incentives: xCONE will also be used as an incentive for using Concentric vaults. So, if you hold xCONE and deposit assets into the Vaults, you earn CONE, xCONE, and a slice of half the protocol fees.

Governance: Another perk of staking your CONE is the ability to take part in governance. xCONE holders will be able to vote on where CONE and xCONE emissions are directed, so users will really want to pay attention and vote.

So, say you’re a truly dedicated user of the protocol. You’ve staked your CONE for xCONE, and you’ve deposited assets into the ETH/USDC Vault. Because you own xCONE, you can vote to increase your own rewards by voting on maximum emissions of CONE and xCONE to that ETH/USDC Vault.

That’s a nice power to have, and it’s just another incentive to invest in the token and stake it. Keep in mind that some users might not be individuals, but other projects looking to incentivize people to deposit into their LP. Those projects can partner with Concentric, buy CONE, stake it, and vote to direct emissions to their native token’s Vault. Theoretically, this will draw more users to deposit into their vault, which would deepen their Camelot V3 liquidity while also helping Concentric and CONE/xCONE holders.

CONE Distribution

Now that we’ve covered token utility, let’s look at the proposed distribution of CONE tokens:

CONE will have a max supply of 1,000,000 tokens with the following distribution:

Emissions – 44% – this will incentivize Concentric Vault users as well as stakers

Public Sale – 20% – this will be distributed via launchpad

Private Sale – 15% – this will go to partnerships within the Arbitrum/Ethereum ecosystem

Camelot LP – 10% – this will fund initial liquidity for CONE to absorb anticipated trading volume

Team – 7.5% – this will go to the team with a six month cliff before any tokens are liquid.

Marketing/Development/Advisors – 3%

Overall, about 38.6% of the total supply will be released as CONE initially, and the rest will either be released as CONE over time or as vesting xCONE. All xCONE can be unlocked as CONE after a six-month vesting period.

Dynamic Buybacks

One feature we’d like to highlight is dynamic buybacks.  Dilution is an ever-present threat in DeFi, so we’ve designed the protocol with a mechanism in place to counteract it.  Within the protocol, there will be a separate Buyback Pool specifically designated to buying back tokens on a weekly basis, funded by 10% of fee income.

These weekly buybacks will have 2 components: fixed buybacks and variable buybacks.

The fixed buybacks are self-explanatory. A set percentage of Buyback Pool funds will be used to buy back CONE every single week to reduce inflation, regardless of its price.

The variable component will depend on CONE’s price activity. When demand is low, or during a sharp decline, the protocol will ramp up its buybacks to help support price. And when demand is high, the funds that would otherwise buy CONE will instead be used within Concentric Vaults. Not only does this boost Concentric’s TVL, but it also boosts the total amount of generated fees, which means higher payouts for stakers and more money directed to the Buyback Pool.

Short-Term Roadmap and Long-Term Vision:

Roadmap:

Concentric has much more planned on its roadmap. We will be releasing our backtest and live test APR soon, and once the audit has been completed, we will launch ETH-USDC and CONE-USDC vaults. After those, Concentric will start researching additional qualified pairs to add to vaults, and proceed with the same structure and rigorous testing that came with our ETH-USDC research.

Vision:

Concentric wants to become a true decentralized market maker. More often than not, trading on DEX’s results unwanted slippage and inefficient price entries and exits that cause long-term sunk costs to trading in DeFi. We want to give better prices and deep liquidity to traders, and reward LP’s with a portion of fees and CONE/xCONE that they can stake for additional ETH-based yield. Over the next 6-8 months, Concentric will transform itself in a true liquidity hub for yield farmers, traders, and potentially lenders and borrowers to become the center of liquidity for Arbitrum.

More details about both of these events will be coming soon on Concentric’s Twitter and Discord, so make sure you check out both of them!