Ocean Market Changes

Analysis & Actions resulting from the liquidity draining attack on Ocean data pools

On Thursday, July 7, we noticed suspicious behaviour in several Ocean Market data pools.

Someone was executing the following set of actions:

1. Stake Ocean in a data pool
2. Buy datatokens
3. Unstake Ocean
4. Sell datatokens

Through this sequence of transactions, small amounts of $OCEAN were being drained from data pools, leading to significant amounts of liquidity being removed and losses incurred by liquidity providers.

After the Ocean community reported this to the team, we did the following:

1. Raised the swap fee to 15% to make this attack unprofitable
2. Discussed how to mitigate the risks in the short- and long-term.

On Monday, July 11, as we were implementing this plan, the attacker re-started their attempts to drain Ocean data pools by bringing over $600,000 worth of $MATIC liquidity to bear. Through a series of transactions, each with over 1,000 embedded operations (with a total of 6,000 separate transactions), the attacker drained larger data pools of $OCEAN liquidity.

We took the following steps:

1. To break the attack, we raised the swap fee to 100%, so any swap transactions going through the Ocean Market would result in all proceeds being remitted to the Ocean community wallet.
2. We committed to the community that all losses would be reimbursed.

Actions from You

We ask you to do the following:

1. Remove any remaining liquidity from data pools now.
2. Publish datasets with a fixed price or free only.

We are now setting up a plan and timeline to execute the following:

1. Remove the data pool functionality from Ocean Market
2. Implement veOCEAN for safe staking and curation
3. Update Data Farming to reward consumption on all priced datasets, regardless of the pricing model. Until then, the Data Farming program will be paused.
4. Thoroughly examine the attack vector and report to partners and authorities as appropriate.
5. Calculate losses from liquidity provisioning for everyone and airdrop compensation.

All other usual Ocean activities will continue without any interruption. This includes:

1. Ocean core development, features and bug fixing
2. OceanDAO Community Funding
3. Ocean Shipyard
4. Ocean Data Bounties

Reading through Telegram, Discord and Twitter, the Ocean team is heartened and encouraged by the support from all of you in the community.

Thank you. We’ll be back shortly with an update.

Follow Ocean Protocol on Twitter, Telegram, LinkedIn, Reddit, GitHub & Newsletter for project updates and announcements. And chat directly with other developers on Discord.