Morpho Integrates Velora for Built-In Token Swaps

Morpho just unlocked faster, more flexible borrowing.

Morpho now integrates Velora’s Market API, offering users token swaps directly within the Morpho interface with no extra approvals or switching tabs.

From one-click position looping to collateral-based repayments and in-app swaps, key borrowing actions are now faster, cleaner, and powered by deep, aggregated liquidity.

What’s New:

Multiply: One-Click Position Looping

Multiply allows users to increase exposure by looping their borrow position in a single transaction. It works by swapping borrowed assets for additional collateral, enabling a higher loan amount without leaving the interface or managing complex steps manually.

• Execution is instant with Morpho’s Bundler3 and Velora’s swapping infrastructure.
• No need for external swaps, everything happens with one click.

📷Caption: https://x.com/MorphoLabs/status/1942582845756899464

Repay With Collateral: Close Positions On Your Terms

Repay With Collateral lets users close a borrow position using their existing collateral, without needing to deposit additional funds into their wallet.

Morpho’s Bundler3 coordinates with Velora’s routing engine to swap a portion of your collateral into the borrowed asset. The system then repays the loan in a single transaction, fully closing the position.

• No manual swaps
• No multi-step workflows
• No balance juggling

It’s a more flexible, capital-efficient way to exit a position, especially when wallet liquidity is limited or price timing matters.

📸 Caption: https://x.com/MorphoLabs/status/1942962182842626550

Built-In Swap Widget

Velora’s swap engine is now embedded directly in the Morpho app.

Users can trade any asset using Velora’s aggregated liquidity, with pricing and routing handled in the background by Velora’s API.

This makes trading frictionless without the need to leave the Morpho interface.

📸Caption:https://x.com/MorphoLabs/status/1945830924681359760

Deep Liquidity and Best Execution

The Velora API connects Morpho to deep liquidity sources across Ethereum, Base, Polygon, and Unichain, enabling real-time access to the best prices and execution routes.

This infrastructure powers:

• Swap execution for Multiply and Repay workflows
• Aggregated liquidity across top DEXs
• Cleaner, bundled transactions for core position management

The result: reliable, low-friction swaps that meets users where they already operate.

Start Borrowing More Flexibly

Multiply, Repay With Collateral, and the Velora-powered swap widget are now live in the Morpho app, available on Ethereum, Base, Polygon, and Unichain with more chains coming soon.

By combining Morpho’s onchain lending innovation with Velora’s execution, we’re setting a new baseline for what borrowers should expect: simplicity, by default.

Explore the integration with Morpho and streamline how you manage borrow positions more efficiently today.

Launch Morpho | Learn More on Velora

The hunt is on. Velora’s new token is around the corner and we’re kicking off the Road to Velora campaign as your chance to gear up, earn rewards, and join the next era of DeFi.

Road to Velora is a four-week staking and trading competition that leads directly into Velora’s new token launch. It’s your chance to explore the power of our new crosschain trading protocol by staking $PSP earning badges, stacking points, and unlocking migration rewards in $VLR.

Whether you’re a DeFi degen or just getting started, the campaign is designed to reward you for your participation in staking and trading performance. Each week, campaign participants will be rewarded with badges after each trade week or hunt. The more badges you get, the more rewards you’ll be able to claim by the end of the campaign.

4 Weekly hunts.
4 Boosted chains.
Multiple point boosters.

The hunt begins now.

The Fast Track to the New Velora Token

Your trading activity from June 4 to July 2, 2025 determines your share of the upcoming token rewards. Here’s how to get started:

Start here: → Join the Velora campaign

Then follow the rewards trail 🐾

1. Stake at least $50 in PSP + ETH to join.
   New and existing stakers are eligible. The more staked PSP you have on migration day, the higher the rewards in $VLR!
2. Complete the weekly hunt on app.velora.xyz to earn points.
   Eligible trades are announced at the start of each week. More volume = more points. You’ll have to stay sharp and move fast to climb the leaderboard. 🐆
3. Boost your score
   Velora is for trading smart. By trading featured chains and tokens, your score will be boosted to a higher amount than other trades
4. Collect your badges
   After the end of every week, Gold, Silver, and Bronze badges are awarded based on your leadership rank. At the end of the campaign, your total badges determine how much $VLR you earn. Your score resets weekly, giving you a chance to climb even higher next week..
5. Refer other traders
   It’s easier to hunt in a pack. When someone you refer trades, earn XP and USDC from their volume traded.
6. Migrate your staked position once $VLR releases July 2, 2025 to claim your rewards.
   Migrating your PSP to the new $VLR token is your key to claiming it all.

Weekly Hunts & Boosted Chains

Every weekly hunt is a new chance to climb the leaderboard and stack rewards with a featured Boosted Chain to maximize your points:

Week 1: Crosschain week

Week 2: Arbitrum

Week 3: Avalanche + Polygon

Week 4: Base + Optimism (Superchain week)

Miss a week? No problem. Scores reset every Wednesday. Finish strong to collect your badges, they’re your ticket to unlocking more $VLR rewards.

Get Ahead of the Game

This campaign is your early access to Velora’s long-awaited token upgrade.

At the end of this campaign, Velora is migrating to a new token that marks a shift in how the protocol works and who it rewards.

Here’s are some highlights:

• A singletoken built for long-term alignment: One token for staking, governance, and rewards. It doesn’t get any simpler.
• Gasless crosschainmigration on Base: Using Velora’s intent-powered technology, migrate your position across chains smoothly to Base for ultra-low fast transactions.
• Professional governance and delegation: Participate in one of DeFi’s fastest growing DAOs or delegate to your favorite represenative to have a say on the growth of the protocol.

The token migration marks the beginning of this new era. But the extra boost–the badges, the bonus rewards, the XP multipliers–only goes to those who start now.

Get Started

✅ Stake at least $50 in PSP + ETH

✅ Head to velora.merkl.xyz/

✅ Complete the weekly hunts

✅ Earn badges, XP, and referral rewards

✅ Migrate at the end to claim $VLR rewards

The more you stake, the more you trade, the more you earn.

This is your chance to be early, be active, and be rewarded. See you on the Road to Velora.

🐆 Join the Road to Velora campaign and start hunting for rewards.

Need more info? Visit the Road to Velora FAQ for all rules, rewards, and timelines.

DeFi started with a promise: open, permissionless access to financial freedom. One wallet and you were in, and in the early days that felt like magic.

But as the ecosystem grew, that magic got buried under fragmented chains, bridging delays, volatile gas costs, MEV exploits, and a dozen other disconnected steps that added more friction.

Today, that changes. Crosschain swaps are now live on Velora.

Velora, formerly ParaSwap, uses intents to offer the most complete trading protocol in DeFi. And now, with native crosschain execution powered by Across Protocol, you can trade smarter, faster, and frictionlessly–no matter what chain you’re on.

What’s New

Velora now supports crosschain swaps and unlocks the power of more advanced strategies, built directly into the trading experience such as:

• Instant crosschain swaps: Trade from ETH on Mainnet to USDC on Base in seconds.
• Stack multiple steps: Bridge, swap, and collateralize in one seamless transaction. We handle the tech so you can enjoy trading.
• Super Hooks: Unlock complex actions like collateral swaps in Aave or automated liquidity management through agents.
• Gas abstraction: Trade across chains without worrying about native gas tokens or topping up balances.
• Superior flexibility: Velora’s intents architecture supports execution across multiple blocks, unlocking financial primitives that traditional DEX aggregators can’t even imagine.
• Advanced limit orders: Set conditional orders that trigger when market conditions are met, even across chains.

Velora goes beyond aggregation to deliver fast, flexible, and transparent access to DeFi.

Why It Matters

As DeFi has grown it has added more and more layers of fragmentation and complexity.

More chains. More apps. More steps. More friction.

Velora solves this by making chain abstraction the default. Powered by intent-based architecture and integrated with Across, Velora turns your intent into action–ensuring that execution is fast, efficient, and secure without needing to worry about managing gas, slippage, or MEV attacks.

This unlocks:

• CEX-grade UX in a decentralized protocol
• New financial primitives powered by agents and Super Hooks
• Composability across Ethereum, Base, Arbitrum, Optimism, Polygon, Avalanche, and beyond

It’s the all-in-one trading experience DeFi was always meant to deliver.

The Velora x Across Integration

To power crosschain functionality, Velora has integrated Across Protocol, the leading crosschain intents protocol in production today. Across isn’t just a bridge. It’s a new paradigm for how users interact with DeFi across chains.

Across Protocol is designed for native interoperability, allowing us to embed native crosschain functionality directly into our app and eliminating the friction of traditional bridging. With a modular settlement architecture, competitive relayer network, and user-centric design, Across enables secure, near-instant execution of crosschain actions, from swaps and deposits to more complex DeFi strategies.

Having Across integrated into Velora eliminates the typical challenges of bridging–no more switching apps, juggling wallets, or worrying about the risks of bridging. Instead, its intent-based system routes trades through a network of relayers and a secure settlement layer purpose-built for crosschain UX, with the lowest fees and fastest speeds in the market.

This integration allows Velora to embed native crosschain functionality directly into the trading experience, making it feel like you’re using one unified platform–even when trading across Ethereum, Arbitrum, Base, Optimism, Polygon, and beyond.

Together, Velora and Across are making DeFi feel like it should: intuitive, fast, and fun.

This is how intent-based trading becomes the default, without compromising decentralization.

“Across Protocol’s integration with Velora is a major step toward unifying Ethereum. By seamlessly connecting Ethereum’s diverse L2 ecosystems, we’re making crosschain swaps feel as simple and intuitive as single-chain transactions. Velora users can now effortlessly trade across chains, experiencing Ethereum as one cohesive network.”

- Across Team

Start Trading and Exploring DeFi as It Was Meant to Be

With crosschain swaps live and powered by intent-based architecture, Velora is unlocking a new era of DeFi trading. Whether you’re making your first trade across chains or building complex multi-chain strategies, Velora gives you the tools to level up.

Over the coming weeks, we’ll be releasing:

• How-to guides to master features like limit orders and crosschain strategies
• Strategy deep-dives to help you evolve from simple swaps to advanced multi-chain trades
• Case studies showcasing what’s now possible on Velora that wasn’t before

Try crosschain swaps now at app.velora.xyz, and show the world what crosschain trading really looks like.

Velora Goes Crosschain: Trade Everywhere, Instantly. was originally published in Velora on Medium, where people are continuing the conversation by highlighting and responding to this story.

ParaSwap is becoming Velora, the complete crosschain DeFi trading protocol built on intent-based architecture.

ParaSwap was initially built to focus on offering the most efficient execution by aggregating DEXs and routing market swap transactions based on speed and cost. Since inception, the protocol has:

• Reached over $100 billion in transactions ($12 billion in the last 90 days)
• Expanded to support Ethereum, Base, Arbitrum, Polygon, Avalanche, BSC, Optimism, Gnosis, and Polygon zkEVM
• Integrated over 100 liquidity sources

ParaSwap was built in the early days of DeFi, when there were far fewer DEXs and much less complexity. With increasing institutional adoption and a maturing userbase, the scope and nature of the biggest challenges have changed considerably in the last few years.

From the early days of x*y=k pools, yield aggregators, and food farms- the space has evolved to a state where institutions are coming onchain in size, pushing the stablecoin market cap to $230B, with almost $8B locked in daily DEX volume alone. DeFi is now at $100B TVL, whereas between 2019 and 2020, TVL ranged between just $300M and $600M, values which memecoin market caps can regularly hit and lose in a matter of minutes.

As DeFi evolves, ParaSwap must evolve too.

From DEX Aggregators to Complete Trading Protocol

Although DEX aggregation remains as important as ever, today there is a huge unmet need for a DeFi trading platform that can offer the same UX, feature set, and performance as CEX venues, without compromising decentralization or composability.

Intents have long been seen as the promised land for onchain finance, as they give the best swaps while retaining self-custody. Unlike traditional DEX aggregators, where users execute transactions at their own risk based on fixed algorithms, intent-based systems allow users to state their goals, and have the goal be executed as efficiently as possible on their behalf. This shift in execution opens the door for agents to determine the best way to fulfill them, adapting in real time, coordinating across chains and protocols, and optimizing for the best result.

To understand the difference, consider the analogy of Uber. Traditional routing is like hailing a cab and having the order fulfilled based on inferred parameters like cost or speed. An intent-based system is like scheduling a ride for tomorrow and having an agent ensure that you’re matched with the best route and cost based on real-time conditions. This agent could coordinate across networks, liquidity sources, and protocols making sure that your order is fulfilled in the smartest, fastest, and cheapest way possible.

Intents enable a more flexible and complete experience, bringing all the possible services, options, and execution strategies into a unified platform. Velora is no longer just a DEX aggregator. It’s a complete crosschain trading protocol built for the next era of onchain finance.

Velora: The Complete Crosschain Protocol

Velora leverages intents architecture to offer several key benefits to DeFi users:

Chain Abstraction as the Core

Velora sets itself apart by making chain abstraction a first-class feature. Its key differentiator lies in executing instant crosschain swaps within seconds, faster than competitors that often rely on slower execution processes.

Super Hooks

Velora introduces a novel approach to hooks, enabling users and developers to create a composable chain of actions by combining swaps and crosschain swaps into a single process. With Super Hooks, users can execute functions that are not possible with traditional aggregation, such as complex collateral swaps in lending protocols or automated liquidity pool management through agents.

Advanced Limit Orders

Users can set conditional orders that execute when market conditions are met, without the inefficiencies of traditional limit order platforms. Following the principle of chain abstraction as default, all orders can be executed on the same chain or across chains.

Superior Flexibility & Market Advantage

Unlike other DEX aggregators, which execute trades within a single block, Velora’s intents system unlocks new financial primitives, making DeFi more dynamic and powerful. This allows agents to also execute more complex strategies to provide innovative execution improvements onchain.

Velora represents a new era in DeFi designed for a crosschain, performance-driven future. Powered by intents, Velora transforms fragmented execution into a unified experience where users can access new financial primitives, on any chain, through a single interface.

This isn’t just a new architecture, it’s a new way of interacting with DeFi. One that is flexible, goal-oriented, and designed to explore the borders of what’s possible.

Alongside our new intents-based protocol, we’re introducing a new brand identity that reflects our new vision. We will share more details as Velora rolls out new features.

Join the Velora Movement

ParaSwap is one of the most battletested and oldest DeFi protocols. Now as Velora, it is ready to onboard the next wave of DeFi. We have a lot planned in the coming months as we roll out our crosschain swap functionality, new features, integration partners, and new agents.

We are looking for traders and advanced users to try the new protocol and give feedback as we release the new features. Stay tuned for more updates in the coming weeks.

Start trading: https://velora.xyz/

Follow us on X: https://x.com/VeloraDEX

Join us in Discord: http://velora.xyz/discord

Unveiling Velora — The Next Era of ParaSwap was originally published in Velora on Medium, where people are continuing the conversation by highlighting and responding to this story.

ParaSwap’s mission has always been simple: deliver the best efficient and transparent access to Open Finance. For years, onchain aggregation was the best way to achieve this, but now the technology has matured enough to evolve past this old system and its hidden limitations. Now, with the transition to intent-based execution, we’re taking a leap forward for both users and liquidity providers.

More than Market Orders

In practical terms, aggregation is not much different from what is traditionally referred to as a market order. Since it has to fetch the rates at a specific moment from the best liquidity sources, the rate is only valid for a short time, and has to be executed within a block with some level of slippage. This is inevitable due to the way AMMs work and rebalance automatically based on the tokens on the pool, and as such orders beyond Market are not possible at the onchain level without fundamental changes from major AMMs.

This is where the changes introduced by Miró change everything, as the upgrades are done above the onchain level. Depending on the type of order an Agent has to execute, it can modify its onchain execution to suit the specific usecase. For instance, it can execute the order across different blockchains, or over a period of time instead of all at once.

With this new level of flexibility unlocked, new types of trades become finally available with all of the benefits of DeFi: Advanced limit orders, DCAs, perps and more.

Bringing the CEX experience on chain is an essential step for mass adoption, and with our evolution beyond aggregation we get one step closer.

Reducing Execution Risk

Besides trade types, accessibility and user experience are also some of the biggest challenges for web3 mass adoption. This not only applies to the visual side of interacting with web3, but also some of the hidden considerations which only advanced users are aware of.

When a user wants to place a traditional market order, there’s a variety of parameters which can cause the transaction to execute less efficiently, or even fail altogether. For example, an improper gas estimation can lead a user either overpaying for their order or not paying enough and the order failing after a peak in network activity. Even prior to execution, if the order is shared in a public mempool, the user can be vulnerable to some MEV attacks which extract value from their swaps. If we want mass adoption, we cannot expect users to have to be aware of all of these technical mitigations.

With intent-based execution, professional agents handle these complexities automatically. Instead of users estimating gas or worrying about MEV, agents compete to provide the best possible execution. This is similar to how the internet abstracts away IP addresses. DeFi needs to abstract execution complexities for mass adoption.

Endless Modularity

Up until now, we have discussed some of the immediate benefits of our evolution beyond aggregation, but the true power of this next step comes from one of the core aspects of DeFi: the ability to connect using financial building blocks.

With the introduction of intent-based execution , agents will now be able to integrate into different protocols seamlessly, allowing for an even greater level of interoperability than before. This, combined with the benefits of not being constrained by single-block execution, will unlock use cases which before would have been impossible.

Building the Future of DeFi with Miró

Project Miró has already integrated multiple agents into its infrastructure, actively executing the most efficient trades for our users. Over time, we aim to establish a robust agent network, making ParaSwap the most reliable trading source in Web3.

These agents, also known as solvers, will compete not only with each other but also with our Market API. If agents fail to provide a better price than the market, our fallback mechanism ensures users are automatically routed through the best available market quote. This guarantees that every trade is executed at the most competitive rate.

A New Identity for a New Era

As our vision expanded, we recognized that this evolution was more than just a technology upgrade, it was the foundation for something bigger. This is why we are rebranding: to align our identity with the future we are building.

Welcome to the Future of DeFi

Project Miró is more than just an upgrade, it’s a revolution in how decentralized trading works.

By moving beyond simple aggregation, we are setting a new benchmark for DeFi innovation.

This isn’t just ParaSwap evolving, it’s ParaSwap leading. The next chapter starts now. Are you ready? 🚀

Why ParaSwap is Evolving Beyond Aggregation was originally published in Velora on Medium, where people are continuing the conversation by highlighting and responding to this story.

Following two months of beta testing of ParaSwap Delta, which processed over $300M across 6,000 transactions, we are ready to go even bigger with our Delta V2.

Delta V2 is now open for everyone to both participate and integrate in. We are ready to bring you the future of onchain swapping and invite every builder to build along with us.

Delta V2’s new auction mechanism allows new agents to participate in the auction. Every time an order is submitted, it is relayed automatically to the Portikus network, where agents will compete to deliver the best possible execution for the user. This allows any agent to use innovative routing and settling solutions to deliver prices that would not be possible through standard smart order routing!

With this new open mechanism and its extended battle-tested period, Delta V2 welcomes ParaSwap API partners to access the Delta auction mechanism for their swaps. This allows for gasless user executions and price competition with an integration process similar to the current one!

If you are interested in becoming a Delta agent, please fill out our onboard request form or using our contact us form

Stay tuned to more upcoming announcements on ParaSwap X account ( https://twitter.com/Paraswap ) and Discord ( https://paraswap.io/discord )

We are excited to announce that ParaSwap Delta, the latest addition to the ParaSwap Product Suite, will be live by the end of August 2024.

This innovative product leverages the advanced Portikus Infrastructure, enabling ParaSwap users to trade tokens without worrying about MEV or gas costs through the ParaSwap UI or API. For those who prefer, trading through Augustus will still be an option.

Why ParaSwap Delta?

ParaSwap’s primary goal has always been to provide the best possible trading experience using Smart Order Routing (SOR) and Best Execution. The first version of ParaSwap, known as Augustus, has successfully delivered over $70B in volume for more than 4M wallets by integrating liquidity sources with open-source and algorithmic excellence.

Now, with the introduction of ParaSwap Delta, we are taking a giant leap forward. By building on top of the decentralized intents infrastructure of Portikus, ParaSwap Delta goes beyond SOR to deliver the best possible execution for its users.

ParaSwap Delta’s Benefits and Improvements

🥪 MEV Risk Minimization
Ethereum.org defines Maximal Extractable Value (or MEV) as the maximum value that can be extracted from block production in excess of the standard block reward and gas fees.

When users submit an on-chain swap, part of the trade’s value may be extracted through front-running, sandwich attacks, and other methods. With ParaSwap Delta, users can avoid many potential MEV attacks currently present when trading on-chain, delivering even greater price improvements.

⛽ Gas Abstraction
Don’t have enough gas to submit a transaction? No problem! Thanks to ParaSwap Delta’s agent-based best execution, anyone can submit a trade without paying gas to submit it directly to the blockchain. Users only need to permit the token gaslessly, and the trade will be executed for them.

🏆 Price Competition: Leveraging Portikus Infrastructure
Thanks to its innovative settlement method, ParaSwap Delta’s price execution will become increasingly competitive as different agents compete to deliver the best possible prices to users.

Currently, many orders that go through Augustus rely on a dedicated backend server for execution, but Delta overcomes this with Portikus.

Portikus, built with maximum modularity in mind, offers a large suite of on-chain execution modules that can add more and more optimizations over time. This allows Delta to expand its functions beyond the initial token swap feature to include high-demand features such as Dollar-Cost Averaging (DCA), Automatic Limit Orders, Stop Loss, and AI Agents, which can be introduced in future releases.

Summary

• Nature of exploit: UniswapV3Callback functionality exploit
• Exploit Amount: $24,000 on the initial exploit, $1,100,000 on follow-up attacks
• Rescued Amount: $3,400,000 by a white hat hack
• Amount returned by exploiters: ~$800,000 as of the time of writing
• Final amount not rescued by the white hat hack or returned by exploiters: ~$300,000
• Thanks to the DAO proposal for PEP-07, a grant was given by the DAO to cover this amount.

Background: Augustus V6

ParaSwap uses a set of smart contracts known as AugustusSwapper to execute the best route calculated. These contracts decode the data provided to build a route the user can swap with on-chain.

As the DEX swapping field advances, ParaSwap has iterated the AugustusSwapper to provide better gas optimizations and swapping functions.

To provide a better trading experience for the user, the Augustus V6 smart contract was developed, which featured various improvements from its predecessor V5, including:

• Increased gas efficiency in swaps
• Additional checks to limit transaction-reverting errors
• Improved scalability for integration of new DEXes

Before its release, the Augustus V6 smart contract was audited by Hacken and Astrasec. Augustus V6 was announced on February 13th and released to the public on March 18th, following the auditors’ recommendations.

Following the public release of Augustus V6, one additional layer of security involved the ParaSwap DAO Bug Bounty program, hosted on the Hats Finance platform through which users can submit potential incidents to the DAO in exchange for a bounty.

Initial Vulnerability Report — MEV Attacks

On March 19th, David Benchimol, a lead engineer at Ironblocks, an end-to-end Web3 security provider automating proactive threat detection, submitted a report through the Hats Finance platform related to a front-running vulnerability impacting Permit2 swaps. ParaSwap took immediate action by removing its support from the UI and API and continuing to monitor the V6 contract behavior in real-time.

Shortly thereafter, a community member reported an unusual behavior on their wallet following an interaction with the Augustus V6 contract. Immediately after receiving the report, developers searched on-chain for similar cases, and the vulnerability was identified. This vulnerability had compromised 5 transactions, all of them through MEV attackers who had automatically exploited the funds. The total loss from these transactions equated to approximately $24,000.

The vulnerability was related to a specific function called uniswapV3SwapCallback(). It’s used as a callback to UniswapV3 direct functions, such as swapExactAmountInOnUniswapV3(). The purpose of these direct functions is to save gas on swaps by significant amounts; they’re basically a gas-optimized replacement to the native UniswapV3 Router. UniswapV3SwapCallback() is called back by a Uniswap pool, but it didn’t implement a proper caller check in some cases, which meant that an attacker could create a fake pool and call that function on behalf of the user in order to drain the tokens they approved for Augustus V6.

Any Uniswap V3 integrated network, such as Optimism, Arbitrum, Ethereum Mainnet, Base, Avalanche, BNB Smart Chain, and Polygon, would be affected.

Due to the nature of the exploit, it was concluded that it was a critical vulnerability and that any user who had approved the contract was exposed to it. To minimize the potential effects of the vulnerability, the team immediately deployed the mitigations outlined in the next section.

Mitigations and White Hat Rescue

The first action taken immediately after identifying the vulnerability was to stop the ParaSwap API for V6. By disabling the API, integrators that rely on it could not build transactions, reducing the exposure to people interacting and thus only affecting users who interacted between March 18th and 20th. In the main user interface, the swapping interface was reverted to Augustus V5.

Following this initial mitigation and in an effort to address the emergency situation as swiftly as possible, a group of security experts, including members from SEAL 911, Origin Protocol, Hats Finance, Conduit.xyz, and Ironblocks, among others, was assembled.

ParaSwap would especially like to thank 0xc0ffeebabe.eth and Daniel Von Fange from Origin Protocol and SEAL 911, who spent an entire night contributing significantly to the mitigation procedures. Additionally, we would also like to extend our thanks to Bogdan Habic and the Tenderly team, who assisted the mitigation team as well.

As the contract itself was not pausable, funds were still at risk of being drained. This led to the conclusion that the best course of action would be to conduct a white hat hack. The white hat hack would involve replicating the draining hack with the largest amount of addresses possible, thus moving the assets to a wallet where the funds could not be drained by a malicious actor.

The total amount of rescued funds equaled approximately $3,400,000, including ~$600,000 (10 WBTC) rescued by 0xc0ffeebabe.eth. With this operation now completed, the next step was to call the contract self-destruct function in the chains where it was available: Avalanche, BNB, and Polygon networks. The function could not be called on Ethereum Mainnet and Optimism due to the recent Dencun network upgrades.

With these measures now completed, the vulnerability was externally communicated to partners that had enabled V6 and users, requesting everyone to revoke the allowances to the contract immediately.

Follow-Up Exploiters

Following these communications, most of the funds that were currently exposed were secured. Despite the measures executed above, there was still an attack vector that could not be saved by the white hat hack on March 19th: if a user loaded a compromised address with approved assets before revoking the allowance, any malicious actor could drain these.

While many of these affected wallets revoked their allowances after the initial exploit, many were still affected despite our best communication efforts resulting in assets worth $1,100,000 being exploited using this vulnerability method.

Hacker Negotiation and Returns

Following the draining of funds from vulnerable addresses, security firms, and local authorities investigated the hackers identified above.

A set of on-chain messages was sent to different hackers with the following message, such as:

Hi, we are reaching out to you about a vulnerability you exploited on AugustusV6. We have taken immediate action by involving the appropriate authorities to investigate and facilitate the recovery of the misappropriated funds.
In the event that you exploited this vulnerability as a white or grey hat, we wanted to discuss the next steps. You can either email us at augustusV6@paraswap.org to discuss further, or transfer the funds directly to 0x66E90d840D7C4F3473E25dD8ca361747058c6Db0
If we do not hear back from you by Wednesday, March 27, 2024, 23:00 UTC we will assume you appropriated the funds with unlawful intent and we will pursue all criminal, legal, and administrative avenues available for the purpose of recovering the misappropriated funds.

Following these negotiations and other exploiters returning part of the funds, approximately ~$800,000 was returned from the original $1,100,000 exploited.

Return of Funds to Affected Users

As the aforementioned mitigations and communications with hackers took place, the process of return of assets secured by the white hat hack began. Transfers were made in batches, with the only requirement from the user being that they have revoked all permissions to the affected contract. This is an important step, as otherwise the funds could be exploited immediately after the deposit of funds.

While the return process for the white hat hack was ongoing, the ParaSwap Foundation put forward a DAO proposal outlining its plans to provide full refunds to affected users with a view to the long-term sustainability of the project.

The Foundation requested the DAO extend a grant to use the DAO’s ETH treasury to provide full refunds for affected users before April 4th. The initial requested amount was approximately ~$864,000 in ETH, but following further developments in the hacker negotiation front, this amount was reduced to ~$340,000.

Following a vote with 96.81% voting “for,” 103 ETH was granted to facilitate the process. This was transferred and converted to the tokens that were drained from users.

The first round of refunds using this grant was sent on Apr 14, 2024:

• Ethereum: https://etherscan.io/tx/0xeba56e080a5d51dcb3a9b166d2a9932a01719e83912c5c6544f72c5477aaf782
• Arbitrum: https://arbiscan.io/tx/0x28ee13ad202f842a8c7117fb038e99c34562bf7a2aa9ba54afcbce93fc306890
• Optimism: https://optimistic.etherscan.io/tx/0x86aa63617a9bf3f1c8cc0ad9d7dd32ed96478da443b0031a8234562b4f369c4e
• Base: https://basescan.org/tx/0xf6739b327caf27d8469085b84776478bd71848405c4880bddd9ff0b33dc957ee
• Polygon: https://polygonscan.com/tx/0x3908a5f6bae95a7f19313634f9fcb5c99fa16248f4dce398d68e5f05b69ff30a
• BNB: https://bscscan.com/tx/0x1b2660f11ed1fb953d89f795454e3c7b67a2ffed9821710796fb2ffe3eaa729c

All other returns, including the grant or the White Hat Hack, can be traced on-chain on each chain on the White Hat address: 0x66E90d840D7C4F3473E25dD8ca361747058c6Db0

Next Steps

Since ParaSwap launched in 2019, security has been the utmost priority for its users. This is the first vulnerability the project has encountered in its five years of smart contract releases.

Despite the mitigations implemented, this incident has shown that for ParaSwap to continue being the most secure interface for users, additional security commitments have to be made. This is why, before the re-launch of the V6 contracts, a set of security updates is being implemented to not only reduce the risk of a similar incident happening again but also ensure that ParaSwap emerges from this as the most secure aggregator in the space.

For the re-audits of the ParaSwap V6 contract, ParaSwap will increase the number of independent auditors from two to five. This will allow for more rigorous testing of the deployed smart contracts and for a higher number of security researchers to verify their safety.

About ParaSwap

ParaSwap is a leading DeFi middleware that unites the liquidity of decentralized exchanges into one protocol.

Our core mission is to drive DeFi participation to new heights by offering secure, efficient, and optimized trading solutions for individual traders and financial institutions to tap effortlessly into the fragmented liquidity pools.

From its inception in 2019, it’s always been ParaSwap’s vision to be a key contributor to a decentralized, integrated, and massively adopted DeFi ecosystem.

Today, we have two major announcements taking us several steps forward in this direction, marking the present and the future of the execution of this vision.

The Present: Announcing ParaSwap Augustus V6

ParaSwap Augustus V6 is a major update to ParaSwap’s V5 aggregator smart contract, which introduces three main improvements that will lead to an upgraded trading and developer experience:

1. Unbeatable Gas Efficiency: the V6 design was focused on optimizing gas consumption along the entire aggregation process. As a result, V6 is the most gas-optimized contract in the aggregator ecosystem, being on average 14.8% more efficient than Augustus V5 and 6.6% more efficient than the current second most efficient aggregator. This implies that users who traded on Augustus V5 and the second most efficient aggregator in the past 90 days would have saved $2.2M and $496,000, respectively, in gas fees if their trades were processed through Augustus V6.
   Optimized gas efficiency should lead to ParaSwap being selected as the source for a trade more often in environments such as meta-aggregators, DEXs, and AMMs using aggregators to do trades and wallets offering simple swap UIs to their users.
2. Integration Scalability: V6 improves the speed at which new liquidity sources can be integrated into ParaSwap. While DexLib already gives developers an independent way to request integrations into our aggregator with +155 integrations, V6 significantly improves the process of reviewing and approving new liquidity sources. The less complex system will expedite new liquidity sources to be added much faster to ParaSwap.
3. Trade Safely: V6 also introduces additional checks to minimize trade reversals and maximize reliability, resulting in a smoother trading experience for API partners and users.
   By introducing additional safety measures for unique tokens like rebase, and new or highly volatile tokens, ParaSwap offers increased peace of mind when trading while reaping all other benefits.

In the last three months, 70% of ParaSwap’s volume came from partners using ParaSwap API. By improving our pricing, their share of transactions should increase, resulting in a significant growth in trading volume in the foreseeable future as more partners upgrade to the new contract.

We are extremely proud of the team for this incredible achievement and excited to see its impact on the trading experience for millions of users. Augustus V6 will be fully deployed to all supported chains in the coming weeks.

The Future: The Dawn of Decentralized Intents

While the new aggregator contract is a great step toward the usability of blockchain trading, in recent months, a key innovation line has taken off to make the experience even more seamless: intents-based architectures.

In today’s blockchain designs, users must declare the exact transaction a protocol should perform on their behalf, specifying most parameters and owning the consequences. To simplify the trading experience, intents-based solutions allow the user to declare the outcome of the interaction rather than the specific steps that should be followed.

As said by Adam Boudjeema, imagine you’re at a restaurant. You order a dish from the menu instead of telling the chef every step of cooking your meal. The chef knows what to do.

Intents enable many other features beyond usability improvements, such as account abstraction, gasless interactions, off-chain alternative quotes for liquidity, cross-chain swaps, chain abstraction, and many more. Thanks to these opportunities, they’re expected to play a big role in the mass adoption of blockchain applications, as they remove some of the most significant blockers for the average user.

Issues with current intents architectures

Our research has identified that all existing intents-based solutions suffer from a lack of trustlessness and decentralization. These issues come down to three key factors:

• Single-point matching engine: Even if different liquidity quotes are given from many parties, there’s always a single entity connecting the user requesting the quote with the final amount provided. Thus, an essential part of the intent computing architecture tends to be hosted on centralized solutions.
• Permissioned whitelisting: Despite multiple parties participating in price auctions, not everyone can onboard permissionlessly in the system to provide liquidity. Instead, a manual process decides who gets to participate in the system. In most cases, this is the same party hosting the previously mentioned centralized matching engine, adding a two-point centralization risk.
• Trust-required code environment: As a single closed entity is running the source code, there is no easy way to verify that the system is acting in a fair and neutral manner. This differs from systems where different entities can compile and run the architecture.

These bottlenecks prevent the conditions of Decentralized Finance from being met. To address this, we have been researching a solution to make the intents ecosystem as trustless and seamless as possible. We’re committed to building this missing piece of critical infrastructure, a decentralized layer for decentralized Intents, dInts.

To understand what needs to be built to create a Decentralized Intents ecosystem, we need to understand how the elements in an intents blockchain setting interact whenever an intent is submitted:

1. End User: The person who wishes to place their order. For most users, the intent trading experience will be no different from that of the usual DEX or Aggregator experience, thanks to the presence of relayers.
2. Relayers: The main role of a relayer is to interface between the End User and the solver. Relayers are not essential for an auction submission, and advanced users can interface with the solver directly without going through one. The role of a relayer is the most flexible one out of all of the parties, but every relayer will have to:
   a. Receive trades from an end-user
   b. Provide quality control of the requests to ensure they are valid (the user has the balance needed to fulfill the trade, for example)
   c. Forward the fulfilled intent from the network to the end user.
3. Auction Participants: These entities interact with the solver to fulfill intents. They participate in the network to deliver the best possible rates for End Users.

For most protocols, the key centralization point is the solver. For that reason, a Decentralized Intents Layer (DIL) is necessary to provide a trustless order-flow-solving infrastructure that relayers can access, and builders can customize to their needs.

Introducing Portikus

Portikus will be a decentralized intents-solving network, a key piece of infrastructure in the intents ecosystem, fulfilling the decentralization and trustlessness principles of DeFi.

By following the dINT structure instead of the centralized solving model, a few new advantages are unlocked from this modularity, such as but not limited to:

1. Relayers can customize their intent experience relative to others while still tapping into the existing Decentralised Layer, being able to bring innovation to the space without losing on the network effects.
2. Users can enjoy significant quality-of-life improvements to their trading experiences, such as MEV protection, Gasless Swaps, or native account abstraction, if the relayers configure their requests correctly.

The launch of Portikus will be phased in five stages in the coming months to onboard various participants into the ecosystem and ensure focus and a smooth and secure experience for all.

• Stage 1 — Doric: users will be able to interact with an intents DEX-like experience with usability improvements like gasless transactions and MEV protection.
  It will be powered by ParaSwap’s aggregator and the first iteration of the Portikus decentralized auction engine while, at this stage, it is still being centralized.
• Stage 2 — Ionic: introducing extra liquidity sources, external solvers, and market makers beyond ParaSwap, all trying to beat the aggregator’s price.
• Stage 3 — Corinthian: launch of the decentralized intents layer testnet network, allowing ecosystem projects to test and integrate the auction engine in their own protocols.
• Stage 4 — Palladium: introduction of a payment model such as Payment for Order Flow (PFOF), Commission-based, Subscription-based, etc, in order to guarantee the sustainability of the network.
• Stage 5 — Vitruvius: upon scaling the node operator set and the first protocols leveraging the network are launched, full deployment to mainnet and realizing the Portikus vision of decentralized intents (dInts) transactions.

We invite anyone who can help us make this a reality to collaborate with us and build in the open future compatible with the core principles that both ParaSwap and the EVM ecosystem are built upon: Open-source, trustless, and secure.

If you are a builder or project interested in helping build this next stage of trading in DeFi, do not hesitate to reach out and help push forward the next stage of DeFi!

Engage

If you want to be part of the community building Decentralized Intents into reality, visit portikus.xyz and mint the Archway Heliasts OG NFT on Zora, available until February 20th.

DeFi Aggregator and middleware ParaSwap has just been released on Polygon zkEVM, expanding its support to eight chains and marking its first deployment on a ZK-Rollup.

Thanks to its effective routing technology, ParaSwap automatically finds the most efficient way of swapping assets across DEXes and other liquidity sources, delivering gas cost savings and pricing improvements compared to alternatives. This has allowed ParaSwap to rank as the second largest aggregator by volume in August 2023, with approximately $1.45 billion of volume exported.

ParaSwap’s deployment on Polygon zkEVM was achieved in partnership with QuickSwap, the first and one of the largest Decentralised Exchanges in Polygon. By incorporating ParaSwap’s technology into its internal routing, QuickSwap can maximize its zkEVM pool liquidity efficiency while offering the best trading execution to users.

Thanks to the technology behind Polygon’s Zero-Knowledge rollup, ParaSwap users can now experience lightning-fast transactions while maintaining the same level of trust and decentralization they love about Ethereum.

With the zkEVM release, ParaSwap is officially deployed across eight chains, including other Ethereum-based rollups. As part of its innovative Social-Escrow model, users interacting with the protocol in any of these chains will be able to boost their PSP stake and, in turn, receive part of the revenue generated by the protocol.

About ParaSwap

ParaSwap is a DeFi middleware and aggregator that unites the liquidity of hundreds of decentralized exchanges, lending protocols, and other liquidity sources into one comprehensive and secure protocol while offering the best route to exchange any asset for another.

By aggregating all these pools into one source, users can exchange for the best rates using an interface or use APIs to incorporate the best rates and liquidity into any project. Be it spot trading, limit orders, or even NFT trading, ParaSwap provides the essential gateway to the best on-chain execution.

Website | Twitter | Telegram | Discord | Github

ParaSwap launches on Polygon zkEVM in partnership with QuickSwap was originally published in Velora on Medium, where people are continuing the conversation by highlighting and responding to this story.