Incident Report: 37,000 SOL in Losses — A Call for Investigation and Action

Thanks for your response. While I greatly support your research, and I highly encourage you to keep going, you are starting with a conclusion and cherry picking data to fit that conclusion, which leads to confirmation bias. You should use data, but look at all of the data to led it lead you to a conclusion, not simply starting with a conclusion and cherry picking specific data points to fit that.


Regarding your points

You started this thread by insinuating that “certain validators had discovered and exploited a vulnerability in the Marinade auction system.” This is a conclusion that is only led to by the data points you are cherry picking. Additionally, that statement alone is an (accusatory) conclusion.

Please note, that I am not trying to call you out here. However, like you, I also think it is important to use data to point out what actually happened. I fully support an independent effort, but I do not support cherry picking specific pieces of data.

I will now address your points 1 by 1.

  • In epoch 766, Marinade slashed most of your stake (from 108,687 SOL down to 1,585 SOL in epoch 767),

As shown in my previous post (with data), I first got the stake in epoch 652. You did nothing to acknowledge the whopping 115 epochs I had the Marinade stake, starting from the very first epoch Marinade ever had an auction. Instead, you brought up the fact that I tried to get the stake back in epoch in epoch 767, where I had the stake for about 2-3 epochs. This is a case of extreme cherry picking, where you are focusing on 2-3 epochs, rather than 115, which I explained how it happened, again with data to back up the claims.

  • And right after that — you immediately increased your bid from 0.01 to 0.75.

Correct, I did. A few points on that:

  1. I had stake for 115 epochs where I was actively paying for it (although less).
  2. The stake didn’t even stick, and I had it for maybe 2-3 epochs.
  3. I didn’t even lower it to what would have helped me the most in this case, because I didn’t even know about the vulnerability. If I was trying to exploit it, as you are insinuating, what would have actually exploited it would have been for me to lower my bid to 1 lamport, not lowering it to 0.01 which you correctly pointed out.
  4. I increased my bid from 0.75 as you said where I paid for the stake. When I decreased my bid to 0.01, you did not even mention I lost the stake again after lowering the bid.
  5. When I did increase my bid to 0.75, the stake was paid. When I decreased my bid to 0.01, the stake was lost. This is actually how the auction is supposed to work.
  • This strongly suggests that you were actively monitoring both your delegation and your bid.

Yes, I am guilty of monitoring stake, along with every other validator in the world.

We’re focused on data , not judgment.

While I support you trying to use data, my constructive criticism for you right now is that you are not using all data available to you. I would like to offer some suggestions to you as I don’t want to pass judgement onto you either.

My suggestions are the following:

  • Start with just providing data instead of staring with a conclusion. This will lead you to avoid confirmation bias on a per validator basis.
  • Include the epoch that each validator got their stake and when they lost their stake
  • Include how much in total each validator paid to the pool.
  • Include the epoch Marinade first went live with SAM.
  • Include the actual exploit and what the ideal bid would be for each validator to pay as little to the pool as possible while maximizing their unstakePriority.

With the data points above, I think that will make your research report much more robust, and will also lead to more of an objective truth which is better for all.

3 Likes