88mph

Summary

88mph (a Back to the Future reference) was one of the first serious attempts at fixed-rate yield in DeFi. Built by the two-person dev shop Bacon Labs — Guillaume Palayer (design/product) and Zefram Lou (smart contracts), who had been collaborating since 2017 (Betoken and other projects) — it launched on Ethereum mainnet on November 16, 2020. The core promise: deposit a stablecoin or blue-chip asset for a fixed term and lock in a guaranteed rate, even though the underlying yield source (Compound, Aave, Harvest, yEarn, Curve strategies) pays a variable rate. The rate risk was transferred to a second class of users — speculators buying "floating-rate bonds" (later "Yield Tokens") who profited if realized variable yield exceeded the fixed rate promised to depositors. Deposits earned MPH token rewards on top; MPH later gained a vote-escrow (veMPH) model with protocol revenue sharing. The protocol was exploited the day after launch (~$100K of improperly minted MPH), rescued the same day with samczsun's help, and later dodged a $6.5M loss when an uninitialized-contract bug was responsibly disclosed in June 2021 for a $42,069 bounty. Despite genuine mechanism innovation and three named audit engagements for v3 (Trail of Bits, Code4rena, PeckShield), 88mph never converted its early attention into lasting TVL, and activity faded as its founders moved to new projects (Lou co-founded Timeless and Sudoswap).

Design (Mechanism)

• Fixed-rate deposits. Users deposit an asset (DAI, USDC, ETH, WBTC, etc.) into a 88mph DInterest pool for a fixed term (up to one year in v3). The pool routes capital into a third-party variable-rate venue. At deposit time the protocol quotes a fixed rate derived from an EMA (moving average) of the underlying venue's historical yield, discounted by a safety margin. Deposits are represented as NFTs, making the fixed-rate position transferable/composable.
• Floating-rate bonds / Yield Tokens. The gap between "promised fixed yield" and "whatever the venue actually pays" is sold to speculators. A funder buys the future variable yield stream on a tranche of deposits, paying upfront the amount needed to cover the depositors' fixed interest ("debt"). If realized variable yield > fixed promise, the funder profits; if it underperforms, the funder eats the loss. This makes yield speculators the protocol's insurance layer against rate compression — an early precursor to the principal/yield-splitting designs later popularized by Element, Pendle, and Sense.
• MPH token incentives. Depositors earned MPH rewards (in v1, partly upfront — the flaw the launch-day attacker abused). MPH staking (later veMPH vote-escrow with gauges) distributed a share of protocol revenue and governed emissions.
• Chain/deployments. Ethereum mainnet was the home deployment; the MPH token lives at 0x8888801af4d980682e47f1a9036e589479e835c5. (Later multichain deployments were discussed for v3; not verified here.)

Outcome

• Nov 16, 2020: v1 launch. Nov 17, 2020: a business-logic flaw in the deposit → fund → early-withdraw flow (unburned funder MPH) let an attacker mint ~$100K of MPH in a loop. Hours later, samczsun found a second, worse bug in MPHMinter access control threatening ~$600K of Uniswap ETH liquidity; the team used it themselves via a privately-relayed (Taichi Network) rescue transaction to drain the pool first, recovering both the liquidity and the attacker's dumped $100K. No user funds were ultimately lost; recovered ETH and reissued MPH were redistributed.
• 2021: v2 and then v3 (audited by Trail of Bits, Code4rena contest, PeckShield) shipped with longer terms, Yield Tokens, and more yield sources. June 7, 2021: iosiro researcher Ashiq Amien disclosed an unprotected initializer in the deposit-NFT contract that would have allowed ownership takeover and draining of >$6.5M across three pools; the team froze the vulnerable path within ~2 hours, moved funds to safety within 24 hours, and paid a $42,069 bounty — an early flagship case for Immunefi-style bug bounties.
• 2022 onward: the fixed-rate category it pioneered was won by others (notably Pendle). MPH's market cap and protocol usage dwindled (circulating supply only ~460–485K MPH; price fell ~55% over 2023 per CoinGecko data); Zefram Lou shifted to Timeless/Bunni and Sudoswap. The site and docs (v4) remain online, maintained by "contributors and the community," but 88mph is no longer a meaningful venue for fixed-rate yield. Exact wind-down date: Unknown / not found.

Why it worked

• Real mechanism innovation: cleanly separating principal-plus-fixed-yield from variable-yield upside, with speculators as the rate-risk counterparty, anticipated the yield-tokenization designs that later succeeded at scale.
• Exceptional incident response: twice (Nov 2020, Jun 2021) the team turned potentially fatal vulnerabilities into zero-user-loss events through fast whitehat coordination, private transaction relay, and transparent postmortems — a model retrospective culture.
• Credible security posture after launch: multiple audits for v3 plus an aggressive public bug bounty made responsible disclosure the rational choice for researchers.

Where the design broke

• Launch-day exploit burned trust at the worst moment: shipping unaudited token-incentive logic on day one produced an exploit on day two, permanently coloring the protocol's reputation during DeFi's peak attention window.
• Two-sided market cold-start: fixed rates are only attractive if depositors get competitive quotes, which requires deep Yield Token demand; 88mph never bootstrapped enough yield-speculator liquidity, so quoted fixed rates (EMA minus safety margin) were often unattractive versus just farming directly.
• Structural headwind: in 2021's bull market, variable yields were high and rising — few users wanted to cap their upside — and by the 2022 bear, capital had left. Competitors (Pendle) solved the same problem with a tradable-market structure that scaled better.
• No mechanism for continuity beyond founder attention: iteration through v1→v4 ran on a two-person shop with no independent contributor base or funded roadmap, so protocol development tracked the founders' available attention rather than a structure that could sustain itself once that attention shifted elsewhere.

Lessons

• Token-emission logic is attack surface. Both the launch exploit and the rescue path lived in incentive/minting contracts, not the core deposit logic. Reward code deserves the same audit rigor as custody code.
• Initializers are constructors that can be called twice. The June 2021 near-miss ($6.5M) came from an unprotected init() on an upgradeable-style contract — one of the most repeated bug classes in DeFi; enforce single-initialization invariants and check them in CI.
• Well-priced bug bounties are cheap insurance: $42,069 to protect $6.5M is a ~0.6% premium; 88mph's payout became a canonical argument for Immunefi-scale bounties.
• Fixed-rate products need a natural buyer of rate risk. Without deep, sustained demand for the variable leg, quoted fixed rates degrade and the depositor side starves — the mechanism can be sound and the market still fail.
• Fast, honest postmortems preserve optionality. "The 88mph Wild Ride" disclosure, published quickly with full technical detail, kept the community intact enough to ship v2/v3 at all.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial analysis — a hypothesis, not established fact. 88mph's core insight (sell the yield upside to fund a fixed promise) was right; its market structure was wrong. A redesign would (1) replace the quote-by-EMA model with an open orderbook/AMM for principal and yield tokens so fixed rates are market-discovered rather than administratively discounted — essentially what Pendle later proved out; (2) drop upfront MPH rewards entirely (they created the launch exploit and mercenary flows) in favor of fee rebates vesting at deposit maturity, aligning incentives with completed terms; (3) launch on a single deeply liquid stablecoin pool with a professional market-maker committed to the Yield Token side, solving the two-sided cold start before expanding assets; and (4) formalize the emergency machinery that saved the protocol twice — pre-authorized guardian pause, private-mempool rescue playbooks, and a standing bounty at a fixed percentage of TVL — as protocol infrastructure rather than heroics. With those changes, 88mph plausibly becomes the category winner it was eighteen months too early to be.