Is Self-custody Safe? $SOL Reducing Inflation, Fake World Assets Cashing In - The Castle Chronicle
PLUS: RH chain post-hype, governance attack on Umbra, Monad TVL doubled in 1 month and other updates
Welcome to another edition of The Castle Chronicle.
This marks the beginning of August, usually the slowest month of the year. This, of course, does not apply to drama, which seemed to abound this week.
Between Coldcard being hacked, putting self-custody and its meaning to the test, and FWA rugging token holders, we really can’t catch a break.
Amidst the more sensational headlines, much stronger fundamental updates such as Solana’s tokenomics improvements risk getting lost.
In this week’s Chronicle:
Solana’s proposal to cut emissions and double annual disinflation from 15% to 30% to reach the net inflation rate of 1.5%.
The Coldcard Vulnerability and how frontier models helped find a 5-year-old bug.
An attack on Umbra Treasury and how it never materialised due to the MetaDAO model.
FWA keeps 100% of Accrued Fees so far to the protocol.
How is Robinhood Chain doing?
Tokens Either Die Young or Live Long Enough to Become Deflationary
Let’s start on a positive note: Solana just put a proposal to a vote which would cut emissions and double ‘annual disinflation’ from 15% to 30%.
L1 tokens are dinosaurs, and we have very rarely seen this kind of proposal recently, signalling a potential broader shift in the market.
This is a massive step forward for a token which has often been criticised for its emissions, which currently has an inflation rate of around 3.7%, equalling over $1.5 billion in SOL distributed to stakers yearly. Solana is now making its token more appetible with a better monetary policy, if you will.
The proposal on the governance forum is SIMD-0550.
0550 is a proposal to reduce inflation by an additional 15%. Solana projects to reach a 1.5% inflation rate as its benchmark rate. This proposal accelerates the road there, with a target for H1 2029 instead of H1 2032.
This proposal will also reduce SOL emissions by over 18 million SOL before reaching the 1.5% inflation rate.
The impact on staking rewards is expected to be as follows:
Current APY: 5.84%
Year 1: 4.34%
Year 2: 3%
Year 3: 2.25%
We refrain from commenting at this moment on how changes in APYs will affect staking dynamics. For now, this change is expected to slightly impact validator profitability. However, given that Solana already had a target set for 1.5% inflation, this was due to happen anyway.
The Coldcard Vulnerability: No One is Safe
While there is no stopping hacks this year, many of them were related to private key compromise through social engineering or at the infrastructure level. But at the end of the day, you feel safe because most of your funds are in a hardware wallet.
This assumption broke last week with the Coldcard hack.
A critical security flaw was uncovered in Coinkite’s Coldcard hardware wallets, enabling an attacker to drain roughly $89 million in Bitcoin from over 4500 bitcoin addresses.
The exploit stemmed from a 2021 firmware build configuration bug that disabled the device’s hardware random number generator. Instead of producing standard 128-bit or 256-bit cryptographic randomness, wallet generation fell back to a predictable algorithm. This compromised the device’s private key entropy, dropping it to a vulnerable 40-bit or 72-bit range. Attackers exploited this by regenerating candidate seed phrases and brute-forcing the private keys to sweep funds.
The most brutal aspect of this attack was that the bug was live for over 5 years and it was never noticed by the code maintainers. Also, as Galaxy traced the wallets from which these funds were stolen, most of them were retail, holding smaller amounts of BTC, ranging from 0.1 - 1 BTC.
This attack also ignited a debate in the security space, as frontier AI models could be leveraged in this scenario because finding this bug was tedious and only LLMs could reduce the time to such findings.
As they can be used in attacks, they can also be used in defence. So every protocol that secures users’ funds behind code should use these models to protect their users by auditing their code with them.
Umbra Protects its Treasury from a Malicious Governance Proposal
On the 1st of August, a malicious governance proposal, UMBRA-004, was created on the governance forum.
The proposal aimed to steal over $1.5 million from the Treasury. The attacker attached enough stake for the proposal to reach the minimum staking amount and go live.
The proposal eventually failed, as the treasury was defended through voting on decision markets, taking positions against the attacker’s proposal.
This is an interesting example of both the risks of decentralised governance and the often underestimated impact of coordination between an aligned user base - and this is also thanks to the MetaDAO model.
Umbra now has to carefully assess the potential for future, better organised threats against its treasury, which is very appealing considering the modest size of the protocol.
Relying on markets to secure governance works as long as the incentives are aligned. This precedent highlights a different kind of market-based governance defence, where participants price and reject a malicious treasury action.
Why We Can Never Have Nice Things: FWA Directs 100% of Accrued Fees ($3m) To Protocol
In last week’s edition, we introduced FWA and how it had grown to account for over 10% of total fees paid on the Ethereum mainnet.
Yesterday, the company announced that the previous fees accrued by the protocols will not be used for buybacks but rather for the protocol itself.
This received backlash, considering that just a few days before the CEO had gone on an interview declaring: “how much of the fee that is currently going to tokenworks should go to buybacks? and that can be anywhere from zero to 100%. will it be zero? no. will it be 100%? no. my gut says down the middle.”
It turned out to be zero.
While token buybacks are not the holy grail of crypto, they are the easiest way for people to monitor whether the team has skin in the game. With time, they have become proxies for token holder revenues, though unjustly.
Considering that a lot of FWA supply is already being minted, reducing incentives to spin the gacha to get tokens, this is another potentially negative setback for broader protocol usage, especially on the day of unlocks.
Protocols should aim to make money.
However, they should aspire to do so without stirring their community or stifling growth.
Users will always want most revenue to be used for buybacks or to go to them.
Teams want it all.
A middle ground should have been the obvious answer: now FWA risks just becoming a fun experiment that lasted a week.
We will continue monitoring the situation and see how things evolve.
Post-Hype Update on Robinhood Chain
Finally, we deserve a little more air time for Robinhood Chain. After flooding our home page with massive hype, RH Chain is now suffering a period of adjustment.
This comes after memes have cooled down, reflecting a slowdown in DEX and launchpad volumes.
However, RH is already broadening its offer to become a more complete ecosystem, as part of its onboarding of several blue chips, signalling a search for maturity.
Taking this all into account, daily transactions are still on a positive trend and at an all-time high.
Currently, there is a fair 50/50 balance between new and returning daily wallets, showing both consistency and that the RH chain is not slowing down in terms of attracting new users.
The initial weeks of development of a new ecosystem are most interesting to observe from a research perspective.
For now, we believe that Robinhood has voluntarily led its ecosystem to be sort of a live experiment and see how market dynamics work. Armed with these insights and data-driven knowledge, we expect them to capitalise on what has made RH chain so appealing while also further leveraging both its huge distribution and monetary and strategic capabilities to bring a wide range of products to further differentiate the eco from others.
On our Radar
Monad’s TVL more than doubled in July, from $350 million to $830 million, primarily driven by deployments like Aave, Pendle and Euler.
What’s particularly interesting about Monad is the focus on making these assets productive, with over $370 million in active DeFi TVL, one of the highest.
Discussions like the one surrounding FWA show how the token question mostly remains unanswered for protocols. Just last week we released a report on (what we believe is) a broken link between protocol revenues and token performance.
Four questions you should ask about a token include:
What are the protocol’s revenue sources and their sustainability?
How do they distribute this revenue to tokenholders?
How much of the token value goes towards emissions?
Is there any existing dual token-equity structure?
Read the full research: https://research.castlelabs.io/p/the-broken-link-between-protocol
Mike from Blockworks appreciated our comments, highlighting the importance these aspects have on investor confidence.
For those of you interested in the perps space or on how RWA products can get better distributions, tomorrow, Wednesday at 1 pm UTC, we will sit down with the CEO of Variational to discuss these subjects! Make sure to join us:
Set a reminder for it:
This marks the end of this edition. We hope you enjoyed it!
To make our content closer to you, we’d love to hear directly about anything you particularly enjoyed or anything you think we should cover.
Feel free to DM us on X, or reach out through our Blog, LinkedIn, or individual team members.
Thank you for your support as always.
Every week for the last 3 years, we have shared our research for free, directly in your email. Not a subscriber yet? Let’s fix it:
PLUS, don’t forget to join our Telegram channel for the latest updates from Castle and all our research: Link here
In our newsletter, we may discuss projects or tokens in which we hold positions. While we aim to provide informative content, our views are not financial advice. Please conduct your research and consult professionals before making investment decisions. Crypto markets are volatile, and past performance doesn’t guarantee future results. Invest responsibly, and be aware of the risks. Your capital is at risk, and we do not accept liability for any losses.