Indexed Finance

Founded in December 2020, Indexed Finance is a DeFi project that uses weighted pools to replicate index funds as seen in traditional finance. Index pools are managed by the protocol's governance token NDX. Anyone in the Indexed community who owns at least 1 NDX can create a proposal. On October 14th 2021, Indexed was exploited for $16m from their indices DEFI5 and CC10.

Indexed Finance logo

History

The beta for Indexed launched on December 25th, 2020. Staking for the NDX governance token began on December 28th.

The DEFI5 (DEFI Top 5) and CC10 (Cryptocurrency Top 10) indices launched on January 17th, 2021.

On February 12th, Indexed reached a peak TVL of $71.42m.

Indexed announced the ORCL5 (Oracle Top 5) Index on February 17th which would contain Chainlink, UMA, Band Protocol, Oraichain, and API3.

The first NDX community index launched on March 1st, DEGEN. If any of the protocols in this index surpassed $2b it would be automatically replaced with the largest market cap token on a list of pre-approved alternatives. At launch, the index contained:

• THORChain, 15.6% ($RUNE)
• Ren, 14.58% ($REN)
• Reserve Right, 10,7% ($RSR)
• Curve, 10% ($CRV)
• 1INCH, 9.2% ($1NCH)
• Ocean, 9.2% ($OCEAN)
• Alpha Finance, 8.5% ($ALPHA)
• BadgerDAO, 8.3% ($BADGER)
• Polkastarter, 7.17% ($POLS)
• Mirror Protocol, 6.46% ($MIR)

Pre-approved alternatives at launch: Sushi ($SUSHI), KeeperDAO ($ROOK), API3 ($API3), Hegic ($HEGIC), Perpetual Protocol ($PERP), Alliance Block (ALBT), Keep3rV1 ($KP3R), Axie Infinity ($AXS), 88mph ($MPH), dHEDGE DAO ($DHT), Whiteheart ($WHITE), Cover Protocol ($COVER), OctoFi ($OCTO), Synlev ($SYN).

The protocol announced an NFT platform index at the end of March. NFTP would contain the following tokens to start:

• Enjin, 23.98% ($ENJ)
• Decentraland, 17.74% ($MANA)
• Sand, 10.36% ($SAND)
• SuperFarm, 8.87% ($SUPER)
• Audius, 8.83% ($AUDIO)
• Axie Infinity, 7.64% ($AXS)
• Ethernity, 6.77% ($ERN)
• Gala, 6.81% ($GALA)
• Rarible, 4.77% ($RARI)
• NFTX, 4.67% ($NFTX)

In May, Indexed announced the Future Of Finance Fund. FFF was made up of three NDX index pools (DEFI5, DEGEN, and CC10) alongside WETH and WBTC.

On September 25th, NDX launched dividend-bearing NDX (dNDX) which would allow NDX holders to receive the revenue generated by the protocol. The revenue is generated from exit fees, 0.5%, when a user decides to leave one of the index pools. For every $100 generated in revenue, $40 would be sent to the NDX Treasury and $60 would be distributed to holders of nNDX.

Exploit

October 14th 2021 was when the Indexed Finance exploit occurred. An address funded by the mixing service Tornado Cash launched a flash loan exploit to impact the weights of assets in certain index pools. Within a week of the exploit, the Indexed Finance team already had a suspect. After looking at previous messages, Doctor Day (a founder of Indexed) and the team believed they uncovered the identity of the exploiter.

In the ensuing months, NDX and the alleged exploiter had a public feud on Twitter. See: https://twitter.com/ZetaZeroes

The exploiter was eventually traced back to a doxxed email account associated with Andean Medjedovic, who was also named in a class action lawsuit organized by the Indexed team.

In late December, a warrant for Andean's arrest was issued. As of April 30th, 2022 he has not been found.

NDX

The NDX token architecture is forked from the UNI token. The token allows holders to add/remove tokens from indices, adjust fees and reserve ratios of vaults, spending the Indexed DAO treasury, and more.

Index pool mechanics

The index pools are all associated with index tokens. Not to be confused with Indexed's governance token NDX, the index tokens represent a fractional ownership of the assets in different index pools. For example, DEFI5 is the index token that represents the DEFI Top 5 index pool. The assets inside of index pools are weighted based on a variety of factors. Each pool has a current constituent list and then a secondary list that is essentially waiting to be put in the pool if an asset falls outside of a given pools parameters. The Indexed DAO doesn't own the underlying assets of any index pool as they are kept within Balancer pools. The ownership of the underlying assets is strictly for the users redeeming their index tokens for the underlying assets.

The Indexed Finance exploiter cashed out the indices for their underlying assets.

Index pools maintain balance by incentivizing users to adjust the token balances and weights on their own. The weight adjustments create arbitrage opportunities for users and achieve a balancing effect on the pools.

Exploit mechanics

Since NDX is essentially a modification of Balancer, swaps effect the balances and weights of the tokens.

The value of pools are extrapolated using the first token with this function:

total_value = token_balance * total_weight / token_weight

A key aspect of the weight is that it can only change by ~1% per hour. This creates a temporary discrepancy which can be manipulated.

In the CC10 (Cryptocurrency Top 10) Index Pool by NDX, UNI was the first token. The exploiter took multiple flash loans and bought out UNI from the CC10 pool.

The balance of UNI became very low very fast, but the weight is only allowed to change by 1%. This decreased the extrapolated-value due to the delay.

With the manipulated value of the pool, the attacker initialized Sushi as a new token in the pool. SUSHI was heavily weighted in the pool due to the low extrapolated-value of UNI, essentially overvaluing SUSHI and allowing the exploiter to mint an excessive amount of index-tokens, such as DEFI5 and CC10. These were cashed out for the underlying assets in their respective index pools for a total of $16M.

Credit to the following resources: Mudit Gupta's Twitter thread, rekt news article, and Indexed Finance's Post-Mortem.