Friday the 13th 2021: PAWv2 🐾

6 min readAug 14, 2021

Bad luck day but swift resolution! In this article, we’ll explain why you had to migrate your PAW tokens as well as announce some exciting news.

ℹ If you don’t care about the detailed explanation for PAWv2 scroll down to read about the Governance votes and the exclusive partnership with RugDoc.io

We’re human (we swear), and humans usually need to sleep which we haven’t been doing a lot of lately.

On Friday 13th, 2021, a small mistake resulted in us having to redeploy a new Masterchef as well as new PAW token.

Here’s the whole story, in detail.

The 30-day Timelock recommendation

As we previously mentioned, we commissioned two different audits for PAW, one from Paladin, another one from Obelisk.

Obelisk found an issue having to do with the transferOwnership function of the Masterchef contract.

This function allows the owner of the Masterchef to be changed and therefore a lot of PAW could be minted if done with malicious intent.

The transferOwnership function is common and is usually simply protected by a Timelock (it was the case for FISH).

Nevertheless, this issue becomes potentially more serious with our vesting mechanism, since rewards are locked for 30 days after being harvested from Farms. The auditor threfore recommended that a Timelock of at least the same length of the vesting period (30 days) were added to the transferOwnership function.

The most logical solution was to add 2 (TWO) separate Timelocks. A standard 6-hour Timelock for the Masterchef, and a 30-day Timelock just for the transferOwnership function.

This is because a single 30-day Timelock would be extremely dangerous since it means that if something goes wrong, we’d have to wait 30 days in order to apply a fix.

And — ironically — that’s exactly what happened.

Friday the 13, 2021 03:54:20 AM UTC

Here’s the transaction where things went wrong.

Basically, instead of putting the transfer of ownership behind a Timelock, the PAW(v1) token itself was put behind the 30-day Timelock.

All actions started to fail (such as deposit, withdraw and harvest) because the Masterchef didn’t own PAW anymore, and couldn’t mint any.

The problem was immediately detected but there was unfortunately nothing we could do other than start writing new contracts right away.

Preventing this from happening again

We’ve introduced an improved mechanism in order for this to never happen again in the future.

The new Masterchef’s ownership can still be transferred, but in order to do this the new owner needs to accept first.

PAWv2, new Farms and Airdrop

We were not going to wait 30 days to take action, that would be ridiculous.

Instead, we deployed a new Masterchef (v3) as well as a new PAW token (PAWv2) so that users could still use the platform with minimum disruptions.

Luckily — since we acted fast — this had very little negative effect and our TVL has actually grown by over $20M since this mishap.

https://docs.polycat.finance/help/migration

We set up a way for users to easily swap from PAWv1 to PAWv2 at a 1:1 ratio (learn how to migrate).

If you have any PAWv1 in your wallet you will see a message saying “You have X PAW to migrate” on polycat.finance.
If you have an LP that was paired with PAWv1 you will see a message saying “please migrate” on trade.polycat.finance/#/pool.
If you have anything deposited in the previous farms you will see a message saying “You need to migrate this farm” on polycat.finance/farms.

Find a tutorial on https://docs.polycat.finance/help/migration.

If you don’t see any messages, then you don’t need to do anything.

Pending PAW Aidrop

Users that had unharvested PAWv1 from previous Farms will be airdropped the total amount they didn’t harvest in a new Vesting Schedule (learn how reward vesting works).

Enough about the past, let’s talk about what’s coming next!

2 Governance proposals are live!

Remember, you can only vote with FISH, Polycat’s governance token

We have our Snapshot strategy to account for ALL FISH 🐟

Whether it’s staked on Polycat, or held in your wallet, or in staked on a external project’s farms (yes, any project), your FISH will be accounted for and you will be able to vote with it (even if paired in an LP!).

Vote now on https://snapshot.org/#/polycatfi.eth!

Governance vote #1 — link

Should the 4.5% performance fee from vaults (currently used to buyback and burn FISH) be ADDED to the Dividend Vault Fund (DFV) to increase it or directly paid as PAW dividends (to those staking in the Dividend Vault)?

Vote now on https://snapshot.org/#/polycatfi.eth!

FISH single-stake Dividend Vault fueled by DVF

Governance vote #2 — link

Currently, the strategy being used to buy back and pay PAW dividends is IS3USD, a stablecoin pool (USDC, DAI & USDT).

We have $2,910,000 in the Dividend Vault Fund (DVF), 100% of the earnings from this vault are used to pay out dividends to those that stake FISH in it.

In this vote, we are going to allow FISH owners to vote on how to split the DVF. How many DVF vaults and how risky.

Riskier strategies offer better APYs but they also expose the DVF to risk of losses, resulting in less dividends. Vote wisely.

Vote now on https://snapshot.org/#/polycatfi.eth!

Partnership with RugDoc.io: Reviewed Vaults

This has been in the works for some time and it’s finally getting close to becoming a reality so we’re ready to reveal it!

RugDoc.io has undeniably become one of the most trustworthy go-to places when it comes to DeFi security. Their cause to make DeFi a safer place is an respectable one with which we identify and fight for as well.

The concept of Reviewed Vaults is simple, Polycat Finance will provide RugDoc with a handy feature to autocompound any reviewed Farms deemed safe by them.

We will have a “Reviewed by RugDoc/Degen” (name not final) section on polycat.finance/vaults. This will allow us to include many more vaults on our platform while making sure they’re vetted by a knowledgeable third-party.

Reviewed Vaults will not be risk-free. There’s always a risk.

Although we do not have an exact date for Reviewed Vaults, approximate ETA is 3 weeks.

DEX aggregator integrations

Firebird has integrated Polycat’s new AMM into their DEX aggregator!

This will result in increased volume for our LPs as well as more fees to burn FISH & PAW!

Remember, Polycat’s AMM only takes 0.24% swap fee, being of the lowest on Polygon.

We’re already in talks with other DEX aggregators to do the same.

Closing words

Here are some numbers:

PAW Farms reached $100M TVL in less than 3 days 🎉 (current total TVL is $140M)
Over 20,000 members are chatting with us every day across all our Telegram groups 🎊
Our Twitter now has a following of over 24,500 cats! 🥳

We apologize for any inconveniences we caused, we will continue building for you all 💜