Solana had 75% of TVL Created By 1 Dev With A Dozen Alter Egos

Solana’s woes continue as news broke that up to $7.5 Billion of its $10.5 Billion peak Total Value Locked (TVL) was created by 1 developer using over a dozen alter egos. Ian Macalinao, the chief dev behind the Solana stablecoin exchange Saber, pretended to be over a dozen different coders on protocols to boost the TVL numbers. Macalinao created a web of DeFi protocols that were all interconnected to create billions in double-counted value on top of the Saber ecosystem. This lead to an inflated TVL on Solana and the appearance of actual users on the chain.

This news comes on the back of numerous Solana system halts and reboots and a series of hacks (a few of which we covered here).

In February the Wormhole Bridge was hacked for $325 million on the Solana side (one of the largest exploits ever).

June saw the Solana chain halted, for at least the 8th time, and the whole chain being down for over 4 hours.

Also in June, Solana voted to seize a whale’s wallet due to having a large loan close to liquidation on Solend. Solend was the largest lending platform on Solana and there were concerns that a liquidation would rekt the entire chain. (Not very ‘decentralized’)

In July, Crema Finance was exploited for over $9 million in a flash loan attack.

August already saw an exploit where over 9,000 Solana hot wallets were compromised. Solana users lost both $SOL and $USDC from Phantom and Slope browser extensions.

The news that over 75% of the activity on the Solana chain may finally be the nail that kills this “Eth killer”.

The Ploy To Boost Total Value Locked (TVL)

Macalinao devised a plan to boost the appearance of on-chain activity by building protocols on top of one another. By stacking protocols and pretending to be a different independent dev for each, Macalinao boosted the TVL of the entire blockchain. At the crypto peak, his protocols accounted for over 75% of the entire on-chain TVL.

The scheme has been referred to as a self-sybil attack. (A sybil attack is when you use bogus identities to gain a disproportionate influence over a whole system).

The scheme even extended to public squares like Twitter where the dozen alternative personalities would respond and interact with one another.

Why Does Total Value Locked (TVL) Matter?

TVL is considered an indicator of on-chain activity. By building protocols that could be stacked on top of each other, each dollar would receive a multiplier in the TVL calculation of the Solana chain.

TVL is only additive if it is done by different independent protocols. If Macalinao was known to be leading each of the dozen protocols, then his plan to boost the metric for Solana wouldn’t work.

By creating various anon alter egos and claiming each was a separate dev building a protocol, he was able to create the appearance of more on-chain activity. For example, if you have a protocol that boosts staking yields by borrowing and staking in other protocols, the TVL of each is considered valid. If you have 2 protocols and you are passing money you oversee between the 2 of them, it isn’t counted as additional TVL.

This makes sense, otherwise you could have a dev keep creating protocols and locking the same dollar over and over across them all. Which is exactly what Macalinao did.

How The Protocol Stacking Worked

An example of how the scheme worked will help clarify what was going on. We included numbers in parenthesis to count the protocols tied to Macalianao.

Cashio (1) had a stablecoin, $CASH, that was pegged to the dollar and backed by liquidity provider (LP) tokens. The only tokens Cashio would accept were Saber LP tokens (2). The Saber LP tokens were packaged up using Crate (3) into ‘token baskets’ called ‘crates’. These crates were sent through Arrow (4) a yield redirection platform. The resulting derivatives were deposited into Sunny Aggregator (5) and Quarry (6).

In this example, $100 of TVL in Cashio was multiplied into $600 of TVL for the entire Solana ecosystem.

DeFi users may not have been able to follow the logic, but by going through the process they were getting 3-5 times the yield on their Saber LP tokens than if they just deposited them directly into the aggregator Sunny directly.

And by pretending each protocol was entirely independent, each step was added to the TVL despite all being a hand-off between related protocols.

At their peaks, Saber had over $4 Billion in deposits and Sunny aggregator had over $3.4 Billion. Since then, both the $SBR token and $SUNNY token are down over 99% while the protocols TVL is down over 95%.

Cashio Hack Breaks The Ruse

In March, Cashio was hacked for $52 million and the protocol imploded.

It was later revealed that Macalinao had rushed the coding of Cashio in order to launch the protocol in time for a developer meet-up, Breakpoint. He was hoping to get other devs to replicate Cashio and push more protocols into using Saber LP tokens.

After the hack, Macalinao eventually fessed up to the scheme as people were starting to put the pieces together and he knew he would be found out soon.

Conclusion: Solana’s Fake TVL

Like most crypto scammers, Macalinao just abandonded ship when thing blew up. He is leaving Solana for Aptos and bringing a copy of Saber with him. The Macalinao brothers set up a venture capital fund that is now anchored in Aptos, called Protagonist.

Saber/Sunny users are abandoned and many still have money stuck in the convoluted derivative protocol scheme.

Ian was allegedly answering questions in discord and talking about more anonymous ‘devs’ who would or would not be working on the Solana version of Sunny in the future.

We hope users will see the ruse for what it is and avoid anything tied to Macalinao or Aptos. However, degens will degen and we are unfortunately pretty certain we will be covering more massive losses in a future update.