Post Mortem: GOLD-USDC Alpha Vault
Incident Summary
During the GOLD-USDC Alpha Vault launch on Meteora, a front-end issue caused the “Withdraw” button to be temporarily not visible on the UI, preventing users from withdrawing their unused USDC from the Alpha Vault.
The issue lasted from roughly 2:10 AM to 3:53 AM UTC+8 (~1 hour 43 min), impacting users who intended to retrieve excess USDC after the Alpha Vault had purchased tokens from the liquidity pool and pool trading became active.
The issue was identified and resolved by 3:53 AM UTC+8, after which the “Withdraw” button became visible, allowing users to withdraw their unused USDC without further problems. Throughout the disruption, the USDC remained secure in the Alpha Vault.
127.0594M out of 127.4396M (99.7%) of the excess USDC have since been withdrawn by users.
What Caused the Front-End Issue
The GOLD-USDC Alpha Vault was configured by the token team to have a 3M USDC max purchase cap. This Alpha Vault eventually received deposits of 130.3665M USDC (4345% filled).
As this Alpha Vault was using Pro Rata mode, 3M USDC would be used to purchase GOLD tokens from the pool to be distributed to depositors, and the remaining unused USDC refunded to depositors. This would be done via a “Withdraw” button appearing after the token acquisition process ends.
However, the token team had set up the launch pool such that the actual GOLD liquidity available in the liquidity pool was lower than what the Alpha Vault was able to buy. When the Alpha Vault attempted to purchase GOLD tokens, it could only buy as much as the available liquidity allowed. In the end, only ~2.9269M USDC was used to purchase tokens (instead of 3M USDC).
The front-end logic for displaying the ‘Withdraw’ button assumed that the keeper would always acquire tokens equivalent to the Alpha Vault’s maximum purchase cap, rather than an amount determined by the DLMM.
This had caused an edge case scenario that was not accounted for in the front-end logic, where all tokens had been purchased without using all the deposited USDC. Specifically, the `hasFilled` flag on the front-end logic did not account for scenarios where the keeper was not able to fully consume the Alpha Vault max purchase cap. This resulted in the “Withdraw” button not appearing after the token acquisition process.
Throughout the disruption, the USDC remained secure in the Alpha Vault. In addition, we have confirmed that there were no other issues during $GOLD’s Alpha Vault launch. Everything such as the program, vault, and keeper infrastructure (that executes the buy) was operating as intended.
Next Steps
We will be conducting a full review of the Alpha Vault front-end code to ensure that the UI functions reliably across various scenarios. As part of this effort, the current open-sourced Alpha Vault SDK will be improved to make it easier to build alternative UIs to the Alpha Vault.
To improve responsiveness, we will also be implementing additional monitoring tools to alert the team of any front-end issues for the Alpha Vault in real-time, allowing us to resolve these issues faster.
As a back-up option, we may also consider adding more functionality to the Alpha Vault UI on the community testing site, Edge (https://edge.meteora.ag/) to accommodate for more scenarios.
(For example, displaying the “Withdraw” button at all times on the Pro Rata Alpha Vault UI, even if there is no excess USDC to be withdrawn. )
This may impact the overall UI/UX on Edge, but it can serve as an alternative platform with additional functionality for users, in the event that any front-end issues arise on the main app.
