ALEX Reopening Roadmap

Security Incident
1

GOi1Yv8XMAECKyD
GOi1Yv8XMAECKyD1200×675 108 KB

Summary of Community Feedback and Suggestions: May 27, 2024

I. Return the Assets That Are Either Unaffected Or Recovered
We would like to update our community on the handling of the recovered assets. While we aim to return these assets as soon as possible, the ongoing discussion on the Treasury Grant program (https://x.com/ALEXLabBTC/status/1794681669179310507…) means that the timing and mechanism of returning the recovered assets are subject to a governance vote and the final Treasury Grant program.

We hope to start the governance vote process to finalize the details of the Treasury Grant program shortly after the AMA on Tuesday.

We will be distributing a special, non-transferrable, voting token to every on-chain $ALEX token holder (i.e. excluding those holding $ALEX on exchanges) equal to the amount of $ALEX tokens they hold as of the Stacks block 150610, including those in the LP positions, atALEX and staking positions and those held at B20 orderbook.

Further details on the governance vote will be announced before the AMA on Tuesday. We would like to encourage every on-chain $ALEX token holder to participate in the vote.

II. Re-opening of ALEX

  1. Security upgrades As we previously announced (https://x.com/ALEXLabBTC/status/1793823753383657813…), a key step before we can reopen ALEX and proceed with the Treasury Grant program is migrating all our smart contracts to a new smart contract management infrastructure. This means all existing smart contracts will be deprecated and replaced with new ones.

  2. Challenges with Current Stacks Infrastructure:
    We recognise that the current Stacks lacks a secure smart contract management infrastructure.

  • The adoption of native Stacks multisig (addresses starting with “SM…”) is challenging for several technical reasons. The tooling around them is very limited, they are not first-class citizens in web wallets, and practically speaking, they are difficult to implement as a solution for running smart contract operations. A good multisig solution is a startup project in itself. Other blockchain ecosystems have projects like Gnosis to handle the heavy lifting.
  • Additionally, hardware wallets cannot be used for command line-based, non-UI-based smart contract interactions (including contract deployment), as there is no concept of a “command line wallet”.
  1. New Solutions: - In light of the above, we worked with the @LisaLab_BTC team to create a new smart contract-based multisig, which is already being used for LISA (https://explorer.hiro.so/txid/SM26NBC8SFHNW4P1Y4DFH27974P56WN86C92HPEHH.lisa-dao?chain=mainnet…) and which ALEX will adopt.
  • We are working with a new project to enable a hardware-based wallet to deploy and interact with smart contracts, which, once released, will augment the multisig to further enhance the security. 4. Contract migration
  • Migrating of AMM and $ALEX token contracts, along with associated contracts such as staking/farming.
  • Coordinating with exchanges for the migration of old tokens held there.
  1. AMM Migration
  • New Smart Contract-Based Multisig: the new AMM contract will be based on the new multisig.
  • Address Screening: We will implement address screening to block any address suspected of belonging to the exploiter.
  • Unaffected Pools Requiring Migration: pools paired with $ALEX such as such as STX/ALEX (legacy), ALEX/Banana, ALEX/Slime, ALEX/USDA, and ALEX/DIKO, will be migrated.
  • Unaffected Pools Not Requiring Migration: Pools like xUSD/USDA stableswap, STX/xBTC (legacy), STX/sUSDT (legacy), STX/Welsh, STX/xUSD, STX/MIA, and STX/NYC can open immediately, subject to community acceptance of the risk of the exploiter moving stolen STX.
  1. $ALEX Token Migration
  1. Migration timeline
  • On-chain holders of the old token can swap for the new tokens on our website at https://app.alexlab.co/.
  • Migration of old tokens held at exchanges will be coordinated with the relevant exchanges. - The public migration is expected to run for about one month (until the end of June). Holders who miss this phase can contact a community manager for migration.
  • There will be no costs for the migration, except for the on-chain Stacks network fee.

Thank you for your ongoing support and feedback.
Your input is invaluable as we work together to rebuild the ALEX platform.

1 Like
3

On point 5 (AMM Migration), while there is a risk, however small, of the exploiter moving stolen STX it would seem very unwise not to migrate the “unaffected pools”. While this doesn’t impact me personally, a second “hack” after the reopening would do lead to irreparable reputational damage.