On Feedback Loops, Market Manipulation, TVL Fabrication, and Trapped Assets in the WAVES ecosystem.
Foreword
This is largely built on a longwinded play-by-play of my investigation https://threadreaderapp.com/thread/1510980620905848837.html with many details omitted, added, elaborated on, and refined.
I have not been compensated for this analysis nor do I hold WAVES and its associated assets nor any position for/against them. Shameless profiteering is exactly what landed WAVES in this boat, and I do not condone nor participate in this sort of behavior. If anything, publishing this will negatively impact my portfolio by damaging broader sentiments and faith in Blockchain and DeFi. This is also why I feel I must shine light on these inconvenient truths; we cannot grow and build legitimacy in this space if it is built on a foundation of manipulation and deceit. So far as euphemisms go, it’s better to rip off the band-aid than let the infection grow.
TL;DR
A number of clearly connected WAVES addresses with significant evidence of a direct connections to Sasha Ivanov and official WAVES infrastructure are directly involved in:
- Creating the false impression of high TVL on the Vires.Finance platform soon after launch
- Upward manipulation of the WAVES price via a positive-feedback loop that leverages infrastructure designed and built by the WAVES team
- Borrowing over 500M USDT and USDC against USDN collateral which by all appearances was used to buy WAVES and mint more USDN for collateral.
— This cyclical borrowing requires a constant influx of USDT and USDC, conveniently facilitated by the platform’s unparalleled interest rates, and prevents liquidity providers from withdrawing their assets - Extensive trading on the WAVES DEX of USDN for USDC, USDT, and other assets which either directly influenced the price of WAVES or were evidently used to do so.
Requisite Reading: a primer on context and further analysis
My analysis was based on groundwork laid by others — there are important details and examples provided in these that I won’t delve into here.
Dec 16 2021 callout that 3P5TkQBU68n6YMiiA8zEVSVqwhLcqNYVBFW alone holds 50% of the TVL Sasha boasted about: https://twitter.com/xGeee/status/1471575396214882307
March 27, 2021: @ericonomic gives the first breakdown describing the infrastructure and methodology used to artificially inflate the price of WAVES, and evidence that the growth was not organic as claimed by the team (Spanish): https://threadreaderapp.com/thread/1508066322592063490.html — huge kudos to him for cracking this one open and for his excellent feedback on this post.
March 31 2021 @0xHamz’s rundown which largely mirrors @ericonomic’s research, but also builds on it: https://twitter.com/0xHamz/status/1509581295621451779
These provide a lot of important information and context, but not enough detail on the scope of things nor evidence linking it to the team.. That’s where I picked up the trail, along with the help of a few cyber sleuths who understandably prefer to remain anonymous.
How to Pump WAVES Indefinitely: A Quick Primer and sample Positive Feedback Loop
1. Borrow USDT against USDN at ~90% collateralization rate
2. Buy WAVES with borrowed USDT, triggering a WAVES price increase (ideally more than the collateralization in step 1).
3. Convert purchased WAVES to USDN; the increased price of WAVES offsets the collateralization rate from step 1, allowing you to redeem you purchased WAVES for more USDN than you had in USDT when you started
4. Repeat.
Note: This is perhaps the most prevalent flow I’ve seen, but the same outcome was similarly achieved using different assets (i.e. purchasing WAVES with USDN, use WAVES to mint USDN, repeat).
This cyclical borrowing requires a constant influx of USDT and USDC, conveniently facilitated by the platform’s unparalleled interest rates. The downside is that it prevents liquidity providers from withdrawing their assets. One must consider the possibility that the infrastructure used to pump WAVES was built with this purpose in mind; it certainly served to significantly amplify the modest gains one might have expected from news of a Ukrainian connection, a few US-based new hires, and an updated roadmap. It’s hard to fly under the radar with 6x short-term growth during a bear market that dragged nearly every other token down in price.
The Usual Suspects: interconnected addresses originally funded from Binance withdrawals
3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr — the mega whale that had 545M USDN collateral against loans worth ~400M in USDT and USDC. Initially funded from Binance in late Nov, 2021, it received a total of 8,672,691.7 WAVES from Binance alone, with evidence of a feedback loop: convert WAVES to USDN, borrow or trade for USDT/USDC, send to Binance to purchase WAVES, withdraw waves and repeat the cycle. Current Vires loan under 5% health: https://vires.finance/as/3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr
3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB — Closely related to 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr with 28 direct interactions and over 60% of their transactions having overlapping addresses. Received a total of 35,182,704.4 WAVES from Binance.
Further detail on connections: https://twitter.com/OrisDorch/status/1512514299851423751
3P5TkQBU68n6YMiiA8zEVSVqwhLcqNYVBFW — initially funded 12/13/2021 by 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr — turned 25.7M USDN into 500M TVL on Vires.Finance. How? By putting up USDN as collateral then borrowing that very same USDN at a 96% collateralization rate, which it put up as collateral and re-borrowed in a loop — https://twitter.com/OrisDorch/status/151367824524546457
Why would you pay interest to borrow the same asset you’re lending? Perhaps this was intended to farm VIRES tokens, or perhaps it was intended to lend credibility to the platform — like the 1 bln TVL Sasha boasted 3 days after this cycle began https://twitter.com/sasha35625/status/1471569328164253710.
3PMUTKMtJxfG5pWZYwRcabnP16HYqo4fYK7 — initially funded by 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr, many transfers to and from 3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB. Received 1,527,416.8 WAVES from Binance. $25M in Vires loans sitting at <4% health: https://vires.finance/as/3PMUTKMtJxfG5pWZYwRcabnP16HYqo4fYK7
3PPuzqQC4bHxWitTyndySGcaMzHHNGipQns — 45 of its 127 transfers are to/from the addresses listed above. Initially funded 2/14/2022 by 3PEwJt4HVarBdY8oTLCrtyGNu9s2NG3sUvQ (I haven’t looked into this one yet) — it initially received WAVES and used them for collateral to borrow USDT and USDC, then settled up in early April, sent the WAVES to a handful of addresses including many listed here (particularly 3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB), then received a bunch of USDN from 3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB which it used as collateral to again borrow ~73M USDC and USDT https://vires.finance/as/3PPuzqQC4bHxWitTyndySGcaMzHHNGipQns — vires loans sit at 4% health at the time of writing.
There are many more associated addresses worthy of further investigation.. A few more that I looked into include:
3PNWjCoZuFyKDz5tvb2YcU5LtcDyyUAxaSh — initially funded by 3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB, busily traded & borrowed against USDN to acquire other assets.
3PK47aHi2BzZGZDnxgWQVF54jDvfMBcggQE https://twitter.com/OrisDorch/status/1511781954215161861
3PMJuZycSwKKg6QpXAbtMtP8beU2au9reVS https://twitter.com/OrisDorch/status/1511782098058756103
The AnyStakeProtocol Connection
Four connected Addresses consistently fund the AnyStakeProtocol Dapp contract on 3P6SFR9ZZwKHZw5mMDZxpXHEhg1CXjBb51y https://github.com/waves-exchange/AnyStakeProtocol. This is an official Waves.Exchange feature used for stalking assets in Liquidity Pools, LAMBO investments, and Algorithmic trading.
The first commit to the AnyStakeProtocol repository was on Dec 21, 2020, which lines up with a few key addresses’ funding. It’s worth noting that the developer behind AnyStakeProtocol seems to have gradually taken over maintenance of the Neutrino contract since his first commit in Feb 2020 https://github.com/waves-exchange/neutrino-contract/. Please do not take this to imply that the developer is the one behind the transactions and addresses noted in this post — I mention this only to demonstrate a connection between the addresses we’re investigating and official WAVES infrastructure.
These four are the only addresses invoking TopUpBalance() https://github.com/waves-exchange/AnyStakeProtocol/search?q=topupbalance for the AnyStakeProtocol’s wallet https://w8.io/txs/g/55905 (with a single exception for 0.000001 USDT — presumably someone probing the contract). TopUpBalance() is differentiated from the put() call that end users invoke for staking.
3PD3oCH6jRsvXYZz9mdX8rShqWKn6DC65zf — initially funded 01/25/2021 by 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr AND 3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR; programmatically tops up USDC
3PMw8Sqeaz9H1QYwWjRYgG6YZGsrKPyru7z- initially funded 12/23/2020 by 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr AND 3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR; programmatically tops up USDT
3PMJYSuMa6BJotRsRn5sUBuEeHuDLMcdSg1 — initially funded 03/02/2021 by 3PGPUHgT3Kp64cjy1eTzJCDs5HhtRHHompW AND 3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR; programmatically tops up WETH
3PGUWV66aEfTm7c71TwYhhuzhsd6LwEbamH — initially funded Feb 17 2021 by 3PGPUHgT3Kp64cjy1eTzJCDs5HhtRHHompW AND 3PDDQvm8Ykj3S7BvqpW99Khx4Vubz62Fk9N — also received 23 WBTC from 3P5TkQBU68n6YMiiA8zEVSVqwhLcqNYVBFW. programmatically tops up WBTC
3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR — I haven’t connected this one as clearly to the ‘Usual Suspects’, but it may be the most important of the lot. This is a waves gateway that was initially funded from Binance way back on 11/23/2019. It proceeded to co-fund 3 of the 4 above addresses linked to AnyStakeProtocol mentioned above — Noteworthy that only 918 of this address’s 62,500+ transactions are transfers (https://w8.io/3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR/t/4). This address is also responsible for the registration of most official WAVES wrapped tokens since 2019 https://w8.io/3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR/t/3 including USDT and USDC. Before this address entered the scene in early 2019 , it seems 3PAfgHQPgodM6MxUzqRkepiKofGnECNoxt5 was responsible for registering WAVES wrapped tokens: https://w8.io/3PAfgHQPgodM6MxUzqRkepiKofGnECNoxt5/t/3 . We can see here that uncirculated asset balances were eventually transferred to 3PMRCnpRfpQzoRgEKX6ZuY2eynBkNoUxzGR in late 2019: https://wavesexplorer.com/tx/7oZaKSRxZbwTBhiCAqwoXUncWRTi9bMsBNqeqQZKqDSh. One must wonder why such a significant address in the WAVES ecosystem would have been funded out of Binance rather than an official treasury address? There’s clearly more to that story, as this is quite probably related to an internal WAVES team transition that changed the platform’s course and led us here.
3PGPUHgT3Kp64cjy1eTzJCDs5HhtRHHompW is another address that provided initial funding to 2 of the 4 AnyStakeProtocol linked addresses mentioned above. Also less clearly connected to our whale, but it does have a lot of transactions with 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr 3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB. Initially funded on 25/02/2020 by 3PCDhTFwXjXbdkg4YczMNe9uNfLcvvsWijk (not yet investigated) and it has a LONG history of buying WAVES, USDC, and USDT for USDN — so follows a familiar pattern.
Further evidence linking the team to these addresses
https://twitter.com/sasha35625/status/1511650307910115334
“Bought 5 mil cheap $USDN […] Now off to buy more cheap $USDN” — the only places with enough volume for a 5M purchase that day were the WAVES DEX and CURVE finance. There was a Matching swap on Curve’s USDN pool: https://etherscan.io/tx/0x553ef0f36baf71867a86837d85c4f52ddf4a2f656f329ac44c1e0ef78ee56e0f. The wallet used in this swap is 0x9c02ac8a9e766a6e4f6987f5ea6aa91d70e932b9. This wallet has used the Waves Gateway bridge a number of times over the past few months, and it purchased another ~5.5M USDN within 24 hrs of the Sasha’s post; ‘off to buy more cheap $USDN’
Looking back a couple months let’s focus on 0x9c02ac8a9e766a6e4f6987f5ea6aa91d70e932b9’s tx: https://etherscan.io/tx/0x4adb8d62f5a4992f9649facc8ad10bd38aaae9988ca8ee09fd624ad80b0e57fb
transferring 2,994,903.202276 USDC to a Waves Gateway deposit address. On Waves side we can see a corresponding transaction for 2,994,903.202276 USDC sent from the Gateway to the all too familiar wallet 3P87zrU6UmJq7wEZz84Fm9PJXr9tLGfEwPB: https://wscan.io/71BxtKp4FEbhTqHm1pPFUcXzbjksUbpsCh6iiGbj8Q6Q.
Another likely Sasha connection with the same ETH wallet 0x9c02ac8a9e766a6e4f6987f5ea6aa91d70e932b9 is here:
https://twitter.com/sasha35625/status/1453704967424991234
- with a corresponding transaction https://etherscan.io/tx/0x98bd9859f53562e66fc40c0194f5d793ab40f09993bddfe403d6e361cab7672e. The twitter timestamp and ETH transaction line up if you adjust for etherscan’s CST time zone and any daylight savings applicable to your region. Mine were off by 3 hours, which lines up after time zone adjustments: https://twitter.com/OrisDorch/status/1512591865341698055
Response to Getting Caught
Rather than denying the accusations, Sasha lashed out at Alameda Research (linked to Sam Bankman-Fried and FTX) — doxing an address as theirs and accusing them of shorting the WAVES platform https://twitter.com/sasha35625/status/1510589946926673920 — triggering a proposal that would force them to settle their position or face liquidation of their collateral, which ultimately resulted in them setting their position. Sadly for them, they now find themselves unable to withdraw their collateral because it is being borrowed — likely by our favorite address: 3PEEsRmcWspCxhKqobvKY3axW1846AMRwzr…
The WAVES team has made no attempt to deny or refute the accusations — instead we’ve seen a circus of distraction, evasion, hype, accusations, and suppression. Anyone who is not overtly positive about WAVES is labeled as paid FUD and censored or ignored; an all too familiar and effective tactic of dehumanizing accusers that piggybacks on a suite of cognitive biases including the self-serving bias, false consensus effect, confirmation bias, group think, The Dunning-Kruger effect, and so forth. Unsurprisingly, this paired with a substantial portion of the market’s obsession with chart-based prediction models has helped buoy the price of WAVES through this ordeal — much to the detriment of those who opt to buy in times such as these.
Further to this — how would one distance themself from an address clearly linked to them? Try to discredit and attack the connections or the people who pointed them out — make it seem as though you’re on the right side of things. Imagine you have 500M USDN tied up as collateral for over 400M USDT and USDC. Considering USDN’s limited adoption, is it really as valuable as USDT and USDC? Might you be inclined to walk away from your USDN — especially if it’s tied up in controversy? Why wouldn’t you distance yourself from the address and try to walk away with 400M of other people’s funds? Not only allowing it to default — encouraging the community to force it’s default under the veil of justice? Well https://twitter.com/sasha35625/status/1513473564112039944 and https://twitter.com/sasha35625/status/1513481492042858499 point to another governance proposal that would adjust collateral rates and force mass-liquidations: https://vires.finance/governance/vote/HBUSKTSQN9LCTejBs2ByipuagNGVxm4dBdH6615SMg43 as well as a 900k repayment by of the 400M+ borrowed USDC: https://wavesexplorer.com/tx/2U3YTYqS8367mRCK5cuvdwN7hUuoXos5N7XV4spXZQf8. Funny enough, this payment came in through an Waves Gateway via transaction https://etherscan.io/tx/0xae3341f8aa8895ea5489fbae50a8b4a885d9fa81b0d14868eae1dc06e74e4105 — the originator was the same ETH address we’ve already linked to 2 of Sasha’s tweets: 0x9c02ac8a9e766a6e4f6987f5ea6aa91d70e932b9
It seems I’m not the only one who feels this way: https://www.coindesk.com/layer2/2022/04/06/waves-founder-blames-short-sellers-for-its-woes-heres-why-thats-a-red-flag/
Aside: compounding price manipulation with WAVES liquidity tied up in Neutrino
[Edit — Disclaimer: I am not as well versed in the Neutrino protocol as I might like to be, so some details in this segment may not be entirely accurate. This portion of the article is not central to the argument, and simply emphasizes that locking WAVES into a contract limits liquidity, which compounds the potential for price manipulation]
At the time of writing there is a circulating supply of 1,023,167,461 USDN.
USDN is backed by #WAVES, which presently has a market cap of 2.23B:
The USDN backing ratio is 133% per app.neutrino.at/buy-nsbt:
meaning $1.37bn worth of WAVES is backing USDN — or more than 50% of all WAVES. This liquidity restriction helps to compound the impact of price manipulation. The amount of WAVES tied up in NSBT- the Neutrino governance token — may further compound this, but I am not familiar enough with how these pieces fit together to be certain of this.
Conclusion
The evidence is clear, and I struggle to draw any conclusion other than Sasha Ivanov’s direct involvement in market manipulation leveraging platforms designed and implemented by his team. I do not wish to speculate as to how this will all unravel, but do wish to end with a message of hope. A few bad apples need not spoil the lot. While it is undoubtedly a difficult road ahead for the WAVES community, there remains a rich and well established ecosystem with a bustling community worthy of redemption. I hope the community takes this as a call to action rather than abandonment, and seeks out a new path forward. Consider looking to Symbol for an example of how you might proceed; they overhauled their leadership, vision, and even access to the treasury via a community hard fork: https://docs.symbol.dev/handbook/vision.html.
Yours in Pseudonymity
— Oris Dorch
P.S. Here are accouple additional twitter threads that touch on this subject:
https://twitter.com/avi_eisen/status/1510651124470239233
https://twitter.com/AirM4rx/status/1510947819833724928
Revisions after publication:
- Added links to 2 twitter profiles mentioned in the article
- removed some crude math from “How to Pump WAVES Indefinitely: A Quick Primer and sample Positive Feedback Loop”
- Added disclaimer to Aside: “compounding price manipulation with WAVES liquidity tied up in Neutrino”