A simple idea of what happened in Rari pool136 is borrowers got away with lenders' stablecoins.
You can see how Rari pool 136 ended up here.https://rari.unixowl.com/pool?id=136
But I believe Rari pool 136 was a stage for exploitation by its pool creator ICHI team.
Summary:
My basic idea of what happened in Rari pool136 is:
Most borrowers(exploiters) are Ichi team-related addresses. The biggest lenders were Onetoken(stablecoin made by Ichi) holders(victims) but their treasuries were managed by Ichi team. You see that Rari pool 136 was under total control of the pool creator Ichi. Do you think that incident was just an accident? Well, I don't.
Also I detected some of team member's addresses and found no address which suffered loss from the incident. Some of them made nice profits. I found some addresses ended as borrowers. Another address sent its gained USDC to another address and from there 140000USDC in total from 13th April to 14th to coinbase. One member with open address rescued money from Rari pool136 very early.
I also detected a team-related address which made huge profit through the incident and sent 1100000USDC to another address. It's still there.
1.Team member's wallets and Team's wallet behind the scene
-How they made profit through the incident or rescued their money from Rari pool136-
Thanks to "withdrawfromsalary" method, I could detect some of team member's address. I found no address which suffered loss from the incident. Some of them made nice profits.
This is how “withdraw from salary” method works. You can see recipient’s address and company’s address in the picture below. Company sends reward(in this case Ichi token) to recipient’s address.
Let’s begin with a member who publicly showing his address.
https://debank.com/profile/0x2ecda5574e4ae1b257eb439bc9930fb3aebef53a/history
danieltal.eth
He received his salary at 2022/01/31. In the next pictures let’s see how he reacted to the incident with a comparison of The No.2 borrower’s transactions. The No.2 borrowed lastly at 23:06 11th April and from 01:10 12th April began compulsory liquidation. He started to rescue his money from Rari pool136 from 00:59 12th April. Pretty early, isn’t it? He in the community acted like “What’s going on? We are collecting infos.” But in the meantime he knew exactly what was going on and successfully rescued his money.
https://debank.com/profile/0xcdcfd445acaf0c3494bb84a551fdac3f1d85b1a4/history
Next address ended as a $22850 borrower in Rari pool136.
https://debank.com/profile/0x22a2e902774a772b9d798ba8e2d1e1de46138be8/history
This address sent its Ichi to this address below.
https://debank.com/profile/0x8a1c82cd4888e93541cad16d63aea190f6a6c449/history
This address made huge profits and sent them to this address below and from there around 140000USDC to Coinbase.
https://debank.com/profile/0x6e6d585f046d372ca9c92d0dc001a726dccfd5bf/history
This is the 7th biggest borrower.
https://debank.com/profile/0x70d08aec714948855fbee7c61b709361be7144b6/history
https://debank.com/profile/0x210c09b2390ee03ee86dd8bb736bda2f31aab57f/history
This one started redeeming from 2022/04/12 05:00:48.
Another bad actor below who ended up as a $700000 borrower started with ETH sent from the address above.
https://debank.com/profile/0xc8a5fbaf0303999f6a241742bf9daa2cd6239b35/history
And this address is from another route. Thanks to Bryan having admitted this address is team's one:
https://debank.com/profile/0x0dd4c0c16fff6693e169ef89235cb92f9d8943ee/history
We can regard the address below as team's one. It also received ETH from Ichi.Farm: Deployer at 2021/01/16 and 2020/12/23.
https://debank.com/profile/0xd5b0a2a96907344a537eb809a0b75b895492e2f8/history
It made a huge profit and sent its 1100000USDC to this address. It's still there.
https://debank.com/profile/0x67532b769c87361a9c5ffae6b441db76fcbc785e
The address below started ETH and USDC from this team’s wallet and made profit through the incident.
https://debank.com/profile/0x8bf0d893af34bbc41ce80fe2f86b8c5298e6ed0f/history
The 4th biggest borrower's address is team’s one because it started with 0.2ETH and later 1ETH from Ichi Farm:Deployer. And it is even a contract creator of wnxm-ichi (0x0002e63328169d7feea121f1e32e4f620abf0352).
https://etherscan.io/txs?a=0x4Fe5f268e5053a05108eBAF13EbD9a825e6fB6f2&p=35
The $114000USDC borrower below received 114663 ICHIBPT(stablecoin) and in return sent 114663 USDC
to No.4. So I regard this address as team's as well.
https://debank.com/profile/0xbddb5d1b761672780bf4859e569f0b212cbf53c2/history
2.What happened in Rari pool136 and the biggest borrower's role in it
My basic idea of what happened in Rari pool136 is:
Most of the borrowers are Ichi team-related addresses. The biggest lenders were Onetoken(stablecoin) holders but their treasuries were managed by Ichi team. You see that Rari pool 136 was under total control of the pool creator. Do you think that incident was just an accident? Well, I don't.
↑Biggest pure lenders in the pool
While having taken profits with their personal wallet or team's wallet, the team did nothing to rescue these treasuries. Because they know their profits comes from these victims' stablecoins.
Let's check other biggest borrowers.
The biggest borrower's address started with ETH sended from Binance and ICHI from Ichi Farm:Deployer.
https://etherscan.io/tokentxns?a=0xC8B5c6363ad036883Fc663766ECd87928Ad3dC36&p=35
The team said the No.1 biggest borrower in rari pool136 was a passionate early suppoter. But now I can see the role of this address is far bigger than it looks.
All of “bad actors” in Rari pool136 below are the No.1 biggest borrower-related address.This is not an ordinary single individual's deed.
https://debank.com/profile/0xe4f4d41bd8da7ae7e638aeac9800e67fcd8e2858/history
This is No.5 biggest borrower's address and it received ICHI from No.1's address at 2021/4/4 and from Ichi.Farm: Deployer at 2021/02/13. This address connects No1. address and Team's. I concluded No.1 address is actually team-related one.
https://debank.com/profile/0x2dddb6a69f071313580073941a4491313303b1ab/history
This address also suggests the connection between them. It sent 0.5ETH to Ichi.Farm: Deployer at 2020/12/15 and 580ICHI to No.1's adress at 2021/01/28.
https://debank.com/profile/0xd1895682591ac2751b10c11f0124fa46e8471562/history ozgjoker.eth
https://debank.com/profile/0xd4099bb6d81e2ea661c6c0417fec4292d48926df/history
https://debank.com/profile/0x71cec0e5114798f5c369c3ce931095daccb17b5c
https://debank.com/profile/0xb3a1242bd37d6d94b320989f16ba4de9e5cedc98/history
https://debank.com/profile/0x0ead347d565ac2cf5b42595be53edf343e52b9d9/history
https://debank.com/profile/0xe3a2f973d2af4f729031d8ae19ab5661ebf02fbb/history
https://debank.com/profile/0xe4f4d41bd8da7ae7e638aeac9800e67fcd8e2858/history
https://debank.com/profile/0x420b02fbb51d65ed2aa877e8b747160699ae0267/history
https://debank.com/profile/0x1fc9cd26854dd3b7c74a36424e130887334a993e/history
https://debank.com/profile/0x1830955ba1ca0a0319857015184e56981ce4877c/history
https://debank.com/profile/0x95881cd5ec6c4c6b5899d453389de5942aa9649e/history
https://debank.com/profile/0x2bdfb91a7d71c0a1865ee7682ef88604905562ba/history
https://debank.com/profile/0xd9101fb1b59cc4b20bcc2eec277a1129b6f87651/history
https://debank.com/profile/0x90d96f507fed5177308c8ebe18fa080d15c59a95/history
https://debank.com/profile/0x5a9519461ab9ab319ce2dde153eb6bac02e14aa5/history
https://debank.com/profile/0x8e14c25262283478a8237b192d6878f734ce647e/history
https://debank.com/profile/0xcae3f36b5ad6ed090794abb8ac00d15af183663a/history
https://debank.com/profile/0x0feb8f4e672af5a07a1400de6621631e668330f1/history
https://debank.com/profile/0x591583182fc7d28a52477444dbc597636ac44fbc indirectly
This address collects USDT from No.1 related addresses and sends it to Binance.
https://debank.com/profile/0xde6568418d895cb8817f4a28cc62a5ca5a879d1f/history
This address collects ETH from No.1 related addresses and sends it to Paribu.
https://debank.com/profile/0x4ac698ceaebaa59a1882960727a44e5d42f8e75d/history
This address was made to send USDT from No.1 to FTX just once.
https://debank.com/profile/0x7397273ac8732bdead972b5b2901b2666c295b91/history
Now you can see how so many bad actors in Rari pool136 are No.1 related and consequently team-related.
As for the 2nd and 3rd biggest borrowers, their addresses are too much alike even to their sub-addresses. I suppose they belong to same person or group.
If the team gets serious about detecting them, they may succeed. Because the 3rd one gained NFT of 28th January AMA with Shapeshift.
Disclaimer: This is nothing but a research made by me. I don't know if it is right or wrong. And I don't need any feedback or correction. This is how I understand what happened in Rari pool136 and I'm content. I let each reader judge whether it's right or wrong and what to do with this research.