armor.fi official response

Summary:

On Feb 04, 2021, 21:45 (UTC), the yearn v1 DAI vault was compromised and 11M in DAI was lost. Armor followed protocol on what is done in the case of a hack, submitted the timestamp of the hack and the protocol it occurred on, then submitted claims for eligible arNFTs. In this instance, there was only 1 eligible arNFT that was submitted worth 1000 ETH.

If successful, what do we plan to do with the funds?
Just last week, Armor launched an industry first Coverage for Coverage Providers, collateralized by the Armor Treasury Reserve. This provides an added layer of protection to the users of the arNXM yield vault to secure it against losses from successful claims at no additional cost.

kferret response: I have never even heard of this. This is an example of how Armor, without the consent of stakers, decided to change the rules about what they can do with our funds. At no point was I ever informed during the staking flow that I would have a risk of loss of benefits during this phase or that the benefits would be used to provide protection to users of another yield vault. Azeem explicitly stated that since arCore Protect is not active yet, if we need to claim we can claim as normal and the benefits still belong to us.

The 1000ETH received will flow into the treasury reserve where they will be used to acquire NXM to replenish the burnt stakes in the arNXM yield vault to fully compensate the stakers of the vault. This will replenish any impacts to arNXM:wNXM ratio.

kferret response: I originally offered to set aside a contribution of $100,000 for the purpose of reimbursing some of the losses in this vault. I think this is quite generous. Azeem agreed to this and seemed quite satisfied, directing his co-founder Robert to start the transfer of the NFT back to me. This never happened. Hours later, “Umadbruhh” delivered the letter to me basically saying nothing the CEO says is binding. When is it acceptable that the CEO can just make a deal, and later on decide that nothing he said applies?

Since arNXM yield vault currently holds 80% of the stakes against the yearn contract through Nexus Mutual, this payout would have come largely at the expense of these stakers.
The Armor treasury reserve will serve its function of being the coverage provider’s cover, and will fully reimburse their losses. This essentially means that the arNXM stakers’ funds will be returned to them.
Separately, arNXM vault stakers are exposed to additional pending claims worth more than 400 ETH that are expected to be approved by Nexus Claims Assessors.
These additional losses would also be covered by the Armor Treasury Reserve.

Response to kferret

Dear x7044, I’m Umadbruhh, co-founder of Armor and responsible for maintaining protocol health. Having discussed this with the team and following the rules as described in our technical documentation, we offer the following resolution.

kferret response: It is important to note that the technical documentation does not reflect the current state of the product. Many, if not most, of the documentation pages at the time contained information that did not reflect the actual working product. Given the complete mismatch, it would be hard to rely on any of the information there. Therefore, I think any reasonable person would expect to be able to rely on the CEO’s statements about how the system is presently working especially if the documentation is largely inaccurate.

Firstly, az’s response in the screenshot is in reference to the ability to unstake; it does not mean that the staker still has coverage while staked. In any event, his statements that any suggestion or proposal made are subject to team approval are not to be dismissed.  In addition, he continues to advise that his discussion with you does not constitute an offer, rather it must be taken as a hypothetical scenario designed to fully understand the matter and to pursue particular solutions. At all times this is subject to approval and is not binding in any way or form.

kferret response: Anyone who looks at the screenshot can see for themselves that this assertion is untrue. Azeem explicitly says “... if not active yet and you need to claim you can claim as normal”. The question is repeated more than once and he answers in the affirmative each time. The person who is able to claim is the person who receives the benefits.

To proceed, you will be aware that all users can request to unstake their arNFT. However, I’d like to remind you that the 7 day cooldown period for withdrawals is to protect the Armor protocol against users unstaking their arNFTs from Armor in cases where valid claims can be made.

Currently, this arNFT is the subject of an active claim, which we interrupted as the system wasn’t ready. Nonetheless, Armor retains all rights to the arNFT and you continue to receive rewards for assigning rights. Consequently, any claims that would be made in this period are owned by and owed to Armor.

As stated above, the informal yet caveated conversation you have had with az does not represent the final decision of Armor as it must be subject to the agreement of the team during the governance grace period or the DAO under normal circumstances. Furthermore, the official technical documentation supersedes any informal discussions or statements that may or may not have been misconstrued.

kferret response: This is just another way to say that we can’t rely on anything they say, everything they say can be false or invalidated whenever they feel like it. Does that sound like the practices of an organization you really want to trust with staking your assets or buying coverage?

You are fully aware that the way the system works is that users like yourself acquire and stake arNFTs with Armor as suppliers. Once staked, the arNFT does NOT provide coverage to the user as it is now leased to the system in return for compensation in the form of token rewards and/or revshare.  (ref - https://armorfi.gitbook.io/armor/products/arnft-coverage-pool/staking-into-arcore)
“Note: Staked arNFTs do not provide coverage to the user who staked them.”
kferret response: Azeem unequivocally clarified that during this stage of the product, while cover brokerage is not active, this is not true and stakers retain coverage and can claim. He confirmed this multiple times.

Armor compensates the stakers with farming rewards and utilization profit share. In the case of a hack, Armor detects the hack and submits all eligible claims from the arNFT’s staked. This can be found here: (ref - https://armorfi.gitbook.io/armor/products/arcore)
Claiming a Payout
kferret response: This part of the product isn’t launched, they are selectively extracting text related to unlaunched parts of the product and adding arbitrary terms and conditions to justify them doing whatever they want at my expense. No one has bought coverage from the Armor brokerage from the pooled arNFTs. It is also unclear if anything resembling a DAO exists at all at this point.

“If a user loses their funds in a smart contract hack, they may claim a payout. A successful claim means that the user will be paid the amount of cover that they were protected for through the Armor contracts.
The Armor system detects and decides on when a hack took place. This will be done through the DAO that determines an exact timestamp for the hack.
Once this timestamp has been submitted, NFTs that have been staked on the Armor contract can be submitted to Nexus Mutual. Nexus Mutual claims assessors will decide whether the claim is genuine and if a payout is deserved.
If the claim is accepted and paid out, funds from the payout go to the ClaimManager smart contract, at which point users can withdraw.
This is the only time the users have to participate in the claims process. The system checks to make sure the user had coverage for the hacked protocol at the time of the hack, and allows the user to withdraw the full amount of cover they were paying for at that time.”
When a hack is detected, Armor claims all eligible arNFTs, which are then assessed by Nexus Mutual, and if successful, funds are paid out to Armor, which are distributed to users. The only time users are involved in this process is after the claim has been paid out and funds are with Armor.

Armor is the sole stakeholder in this decision because:
Armor retains all rights to the arNFT when staked, so all claim submission rights and payouts belong to Armor during the period the arNFT is being staked. This includes the 7 day cooldown period after the unstake request has been triggered, which was included to address instances similar to this and to allow Armor DAO to determine the appropriate course of action.
If the arNFT is allowed to be withdrawn, Armor DAO stands to lose a significant amount of its stake on the yearn contract which will be paid to someone who did not own the rights to this claim. You will appreciate that this is neither ethical nor payable in the circumstances.

kferret response: Just remember, the next time Armor is going to make a decision about your assets, this is going to be their mantra: “Armor is the sole stakeholder”. Armor only looks after Armor. They have clearly demonstrated that now.

In this instance, the arNFT in question meets eligibility requirements for immediate submission as no proof of loss is required. The other arNFTs that require proof of loss do not meet this criteria. The specific logic chain for decision making in this instance is as follows:
arCore protect does not have any users who were using this coverage
Therefore, no one who would be covered by this arNFT at the time of the hack has suffered a material loss
You as the user who staked the arNFT are not covered by it, as explained above
Armor will claim the payout and use it to compensate arNXM yield vault stakers

The normal course of action would have been the claim is made and paid out to the Armor treasury. But since we realise that no material loss has resulted to users of arCore Protect in this hack or anyone covered by this specific arNFT, it is imperative for Armor to determine the best decision for the protocol and community that is fair and justified. Therefore, Armor will claim the payout and use it to provide coverage to stakers in the arNXM yield vault.

At the same time however, we would like to come to an amicable understanding with all parties. You are a supporter of Armor for which we are grateful and honored. This is simply one of the reasons we feel you will agree that any decision must be made transparently and should not be made unilaterally or without the existence of any duty, in order to benefit any one specific user at the expense to and indeed of the community.

kferret response: Armor’s definition of coming to an amicable understanding with all parties must mean agreeing to a deal, then totally reneging, then informing me all of the final terms of a completely different new deal in which only Armor got to select all of the terms and I had no say at all. Yes, this certainly sounds like it’s not “made unilaterally”. This is full of meaningless words from “Umadbruhh” that almost seem like taunts given how far from the truth they are.

The best decision must be made in the interest of Armor and our stakeholders and must be fair and justified. Armor as a broker of coverage, owns the coverage when it’s not being brokered. As such, we must advise that you presently do not have any rights to the arNFT according to the rules of the protocol. This is irrespective of any informal discussions previously with any of the individual co-founders which were always subject to  the explicit agreement of the founding team during the governance grace period and/or the DAO.

Armor will proceed with claiming the arNFT in the interest of our community and serve its original intent, which is to provide coverage to our users.

I trust this concludes the matter.

Kindly,
Umadbruhh