📣 Our community asked, we delivered, the new dashboard is here! 🚀

At Exactly, we aim to bring an improved decentralized lending and borrowing experience, offering a simple and clean interface making it easy for users of all levels in DeFi.

Using the new dashboard, users can enjoy a simple overview of their deposits and borrows while having a complete vision of their portfolio 📈

In Your Account section, users can also see their Health Factor, Borrow Limit, Net APR and Net Position.

🔗 https://twitter.com/ExactlyProtocol/status/1691122066316279809?s=20

We're actively investigating a security issue within our protocol. To ensure user safety, the protocol is temporarily paused (you can still withdraw assets). Our team is on top of this and will share more details asap.

A message to the hacker has been sent to talk about potential next steps.

https://etherscan.io/tx/0x91dd9c55e1d51f7ada448b2aec4552d9bbf5aa02b33f796d29509e4e0b2fe3d1

An upgrade to fix one of the periphery contracts was scheduled. As this change has a 24-hour timelock to be executed, the protocol will be unpaused on August 19 at 10 am UTC.

After the protocol is unpaused, users will be able to perform all operations.

The unpause of the protocol will be today (August 19th) at 11:51 pm UTC. The team has implemented extra measures to enhance the process, but we understand this may still be an inconvenience. Your patience and understanding are greatly appreciated during this time.

Yesterday, the DebtManager periphery contract was manipulated. The attacker passed in a malicious market contract address, bypassing the permit check, and executed a malicious deposit function to steal assets deposited by users. Approximately $7.3M were stolen.

The attackers’ addresses in Optimism are:
Exploiter 1: https://optimistic.etherscan.io/address/0x3747dbbcb5c07786a4c59883e473a2e38f571af9
Exploiter 2: https://optimistic.etherscan.io/address/0xe4f34a72d7c18b6f666d6ca53fbc3790bc9da042
tiffa.eth: https://optimistic.etherscan.io/address/0x000000000000be0ab658f92dddac29d6df19a3be

A fix was proposed yesterday and approved by the governance multisig and will be executed today at 23:51 UTC, together with the protocol unpause. The txs are here: https://app.safe.global/transactions/queue?safe=oeth:0xC0d6Bc5d052d1e74523AD79dD5A954276c9286D3.

Additional details regarding this exploit will be disclosed over time through a post-mortem report.

We are currently trying to communicate with the attackers to return the stolen assets. Police reports have already been filed. Additionally, our team is actively collaborating with Chainalysis and other security experts to identify the attackers and take appropriate measures.

https://twitter.com/ExactlyProtocol/status/1692950170705518879?s=20

The protocol is now unpaused. Users are able to perform all operations.

The protocol is now unpaused. As we announced, users are able to perform all operations, and no liquidations have occurred.

For clarity, the hack affected only users who engaged with the peripheral contract (DebtManager). Those who didn't use this contract experienced no losses, and the protocol remains fully functional.

Concerning the hacker and fund recovery efforts, our team is actively working on multiple fronts in parallel. Once we have updates, we'll present the findings and suggest potential strategies for the DAO to vote on.

We are also working on a post-mortem report for an in-depth incident analysis. This report will be shared with the community in the following days.

https://twitter.com/ExactlyProtocol/status/1693304412356108736?s=20

We're now working with some of the same team that helped @eulerfinance and many other protocols to recover their stolen funds. This includes but isn't limited to @cryptogle, @euler_mab, @aliciakatz, @tayvano_, and several others.

We will also officially launch a $700K reward as an incentive to the community to help with the cause if by tomorrow we haven't received a reply from the attacker.

We've sent them a message in this tx:

https://etherscan.io/tx/0xaf75c6afb808742276e34a5de5a3c3daebe0d0925e3b4e6bc133be33bda4eec4

Special thanks to those mentioned above, as well as @sheikhswampert @Mudit__Gupta @wschwab_ @samczsun @hudsonjameson @chainalysis and the others who wish to remain anonymous for their ongoing support in this process.

https://x.com/exactlyprotocol/status/1693756960980545951?s=46

Exactly is officially announcing a bounty of $700,000 for any information that results in the recovery of all stolen funds and the arrest of the attacker responsible for the protocol hack.

If you have any information you believe will be helpful, please contact us: hello@exact.ly

In our commitment to transparency and to increase user safety, we want to inform our community that we have temporarily disabled our web app’s Strategies Section, including Cross-Asset Leverage and Deleverage and Rollover features related to the DebtManager peripheral contract. This decision directly responds to the events that have impacted our platform.

At the same time, we will begin a formal audit process of these features in collaboration with ABDK, a leading security firm in the field that has already audited the protocol, and we are looking forward to reintroducing these functionalities in September.

We pledge to share the audit results in our documentation, ensuring transparency.

More info here: https://medium.com/@exactly_protocol/update-on-the-web-app-strategies-section-8be4b60b13d5

Exactly Protocol Incident Post-Mortem is now live.

Our team has developed a Post-Mortem analysis of the incident that occurred on Aug 18, 2023, that resulted in financial losses approximating $7.6 million.

The root cause of this compromise was traced back to vulnerabilities within the DebtManager smart contract.

In short, the DebtManager contract was exploited due to a combination of inadequate design on the input validation mechanisms and unchecked permit schemes that paved the way for attackers to exploit the system.

In our commitment to turn this difficult chapter into a pivotal moment for reinforcing our protocol security measures, we are initiating rigorous audits and implementing a more robust Bug Bounty program, among other measures outlined in an action plan to be released soon.

🔗 You can read the detailed report here: https://medium.com/@exactly_protocol/exactly-protocol-incident-post-mortem-b4293d97e3ed

Dear Exactly community members,

It's been four weeks since the attack on our protocol, and we have given the attacker enough time to do the right thing. Unfortunately, they have chosen not to even communicate with us.

So we have had to do what we said we would: involve outside authorities. As of two days ago, we have been in contact with the United States Department of Homeland Security (DHS), which has assigned a team of agents to our case.

The attacker can still return the funds, but it has to be 100% instead of 90%. If they return it all, we'll drop the case. If they don't, we will cooperate in every way possible with the agents and our partners to find and prosecute fully those who stole our investors' funds.

If anyone has questions, please get in touch with us at hello@exact.ly

https://x.com/exactlyprotocol/status/1702805317904453869?s=46

Dear Exactly community members,

After conducting a post-mortem analysis we committed that all features within the Exactly web app, including all protocols and peripheral contracts, will only be accessible to users after a thorough audit. We want to announce that ABDK Consulting, a leading security firm in the field, successfully audited the DebtManager peripheral contract. As a result, the Strategies Section was enabled back in our Web App.

More info in this article: https://medium.com/@exactly_protocol/the-web-app-strategies-section-is-back-51bf622d77e9
Please check the new Strategies section: https://app.exact.ly/strategies

The Homeland Security Investigations’ case number for the Exactly Hack is NY02HR23NY0001.

If anyone has information to share please contact us at hello@exact.ly and we'll connect you with the Cryptocurrency Task Force of U.S. Dept. of Homeland Security in New York.

Dear Exactly community members,

📣 We want to announce a significant milestone in our journey towards decentralization: The Exactly Governance is Here!

Every community member can now actively participate in shaping the future of Exactly Protocol.

How to Get Involved:

- Explore the Snapshot Page: Head over to our Snapshot page, where you can find all ongoing proposals. https://gov.exact.ly/#/
- Participate in Exactly Improvement Proposals (EXAIPs): Vote on proposals that impact our protocol.
- Share Your Ideas: Have a suggestion in mind? You can now submit your proposals to be voted on by the community.

👉 Read the full announcement here: https://medium.com/@exactly_protocol/the-exactly-protocol-governance-is-here-281ac8b5df94
👉 Governance documentation section here: https://docs.exact.ly/governance/exactly-protocol-governance

🗳️ Introducing [EXAIP-01] Transitioning to EscrowedEXA rewards (esEXA)! We invite you to explore the proposal details on our Snapshot page and have your say in shaping the future of Exactly Protocol. 👉 https://gov.exact.ly/#/proposal/0x889d08cbe0ed7be4fd437ca374ef2845b4dbd641a6d2c57e76cd2c54d47fcadc

Dear Exactly community,

📣 We want to announce [EXAIP-02] Adjustments to the EXA token distribution scheme. This proposal outlines the adjustments to the EXA token distribution scheme in response to the Exactly Incident on August 18, 2023. The objective of these proposed changes is to safeguard the interests of our users, community members, core team, advisors, and investors while ensuring the resilience of the Exactly Protocol.

Key aspects of the proposal include:

- Postponement of the initial claim date for investors, advisors, and team members to June 1, 2024. Extension of the lock-up period to 48 months, starting from June 1, 2024.
- Transition to EscrowedEXA token rewards (esEXA) for community rewards, in line with the EXAIP-01 proposal.
- Extension of the emission period for esEXA tokens until May 31, 2028.

We invite all community members to review the proposal and share your thoughts.

👉 For full details, please visit the Snapshot link: https://snapshot.org/#/gov.exa.eth/proposal/0xe8582ed61b471cddedf865aad15138503f4bd71813ece8c66f0325507ac1c2f9

Dear Exactly community,

🥁 Say hello to esEXA

After passing the voting process, the [EXAIP-01] Transitioning to EscrowedEXA rewards (esEXA) has just been implemented.

In our commitment to ensure the long-term sustainability of the Exactly Protocol, the transition from direct EXA rewards distribution to the introduction of the esEXA, with a linear vesting period, has just started.

Elements for the esEXA to EXA conversion process:

- Burning Mechanism: Holders will burn their esEXA tokens to initiate the 12-month vesting period and convert them into EXA tokens, through Sablier.
- EXA Reserve: Holders must reserve some EXA tokens to start the vesting process. Initially, the reserve percentage will be set at 15%.

OpenZeppelin and ABDK have audited the new EscrowedEXA smart contract 🔒✅

Read the full announcement 👉 https://medium.com/@exactly_protocol/exaip-01-transitioning-to-escrowedexa-rewards-esexa-d387e1f63600

🔗 For detailed information, check our documentation: https://docs.exact.ly/governance/exactly-token-exa/escrowedexa-esexa

Dear Exactly community,

📣 We want to announce that [EXAIP-02] adjustments to the EXA token distribution scheme have passed the voting process and it was implemented.

These changes have been carefully crafted to protect the interests of our users, community members, core team, advisors, and investors, all while maintaining the resilience of the Exactly Protocol

Details:

- Postponement of the initial claim date for investors, advisors, and team members to June 1, 2024.
- Extension of the lock-up period to 48 months until May 31, 2028.
- Extension of the emission period for esEXA tokens until May 31, 2028.

👉 Read the full announcement here:
https://medium.com/@exactly_protocol/exaip-02-adjustments-to-the-exa-token-distribution-scheme-c8e54f503128