chore: add lender borrower disclousure (#87)

disclosures/2024-1-03.md

@@ -0,0 +1,41 @@
+# Incident disclosure - 2024-01-03
+
+## Summary
+During the extreme market volatility that occurred on January 3rd one of Yearn's Compound Lender Borrower strategies was liquidated.
+
+All user funds are safe, and no action is needed.
+
+This particular strategy uses WMATIC as the underlying asset and the collateral in Compound. When MATIC price rapidly declined the open debt position quickly became unhealthy and the position was liquidated before keepers were able to tend the strategy to remedy the situation.
+
+The loss from the liquidation was roughly $18k. However, the liquidation removed the collateral of the strategy and replaced it with a cUSDC position.
+
+The strategy is still earning yield on the remaining cUSDC held within the strategy, but withdraws were limited due to funds being held in cUSDC not the underlying WMATIC. A deposit of 147,020 WMATIC was made into the strategy to take over the position and allowed for a full withdraw from the corresponding Vault resulting in no losses to any users.
+
+Yearn strategists will hold the strategy position and continue to upkeep and compound the rewards it is still earning to slowly build back the amount deposited.
+
+## Background
+- The strategy supplies WMATIC to Compound as collateral and uses it to borrow a specific amount of the "base token" (USDC) and then supplies that USDC back into Compound through a corresponding "Depositor" contract.
+- The strategy farms the COMP rewards earned from both lending and borrowing that are higher than the difference in lend/borrow APR.
+- The strategy had a total of 147,011.23 WMATIC in debt from the corresponding vault.
+- The strategy now holds roughly ~$110k of cUSDC.
+
+## Details of the Issue
+The issue results from two separate concerns.
+1. Keepers did not re-balance the position as they are meant to, due to a misconfigured `tendTrigger`.
+    - To limit the gas used for maintenance tasks such as LTV adjustments a `maxTendBaseFee` was used during the tend triggers.
+    - Because of the extremely rapid decline in price, gas fees were elevated for the entire time (< 10 minutes) the LTV was above the strategies `warningLTV`.
+2. The funds left in the strategy post liquidation are not the same as the underlying asset.
+    - The strategy is fully immutable and as such does not allow for the withdraw of a different token than the underlying.
+
+
+### Next Steps
+To prevent similar issues in the future, a few additional steps have/will be taken:
+- Funds from all strategies containing similar code have been withdrawn.
+- The strategies will be re-written to not use a `maxTendBaseFee`.
+- Swap paths for any potential non-underlying token the strategy may hold will be included.
+- Add checklist on security review for leverage strategies in networks that are different from mainnet.
+
+### Resources
+
+1. https://polygonscan.com/tx/0x09983486792459ae5a3b79d703ce3610370003038020a6f67d4b9fb7330af02b
+2. https://polygonscan.com/tx/0xddf017e4db0cd7b59edeaedcc6f574bf5a000f88454c8454a68e80f2198792d9