DeFi Exploits Can’t Be Pinned on Flash Loans, Industry Leaders Say
Published
1 Monat ago
on
By
Nine months ago, in a Denver convention center, a booth sat empty.
Littered with token stickers, the table was supposed to hold the physical representatives of decentralized finance (DeFi) protocol bZx. It remained empty, however, as the team struggled to make sense of the digital forces twisting their young project.
bZx, as they would come to find out, was 2020’s flash loan “patient zero”.
AFTER THE HACK: DeFi protocol bZx’s booth sits empty at ETHDenver. (CoinDesk archives)
Flash loans remain the common thread through all those recent attacks. These DeFi-native tools enable a savvy investor to take out unbacked loans and amass leverage behind a position. For example, Monday’s Origin Protocol attacker pulled a 70,000 ETH loan from decentralized derivatives platform dYdX. It enabled the attacker to up the amount of loot sucked out of the project.
Yet, while they may be the string connecting these exploits, flash loans are not the cause in and of themselves, industry leaders told CoinDesk.
Oracle manipulation and flash loans
It may not even be fair to characterize the recent DeFi exploits as “flash loan attacks,” Chainlink co-founder Sergery Nazarov told CoinDesk in an email.
Nazarov said flash loans at their core are just lump sums of capital thrown at success trade positions. The real issue lies with poorly constructed DeFi projects.
“While many are trying to frame this trend as the result of flash loans, most of these exploits could have been committed by any well-capitalized actor. All a flash loan does is temporarily make anyone a well-capitalized actor,” Nazarov said.
Read more: Everything You Ever Wanted to Know About the DeFi ‘Flash Loan’ Attack
DeFi’s projects are smart contracts deployed to the Ethereum blockchain. They require outside information, namely pricing data, to execute actions baked into each contract.
That pricing information is liable to distortions simply because of how the Ethereum blockchain packages transactions – that is, every 15 seconds. Prices can move every which way in 15 seconds, which forces smart contracts to act on stale data.
Moreover, many DeFi applications rely on in-house pricing oracles created by token reserves, non-decentralized pricing feeds or other ad hoc solutions. For example, Harvest Finance leaned on another DeFi project, Curve Finance, to price its token pools.
In cases like Harvest Finance, interoperability became a negative dependency. A flash loan worth $50 million deviated asset prices temporarily away from the market value, creating an arbitrage opportunity. A project that had a more robust pricing system wouldn’t have fallen prey to the exploit, the theory goes.
Are audits enough?
Another point developers are coming to grips with is that code audits alone don’t make a DeFi project safe.
Speaking with CoinDesk via Whatsapp, Quantstamp CEO Richard Ma said developers need to understand markets themselves, perhaps more so than the code they deploy to the Ethereum blockchain. Quantstamp has audited or consulted on multiple top DeFi projects such as Curve Finance, MakerDAO and SushiSwap, among others.
“Understanding the products and the business logic is much more time-consuming and important than a straight-up code review,” Ma said.
Indeed, Akropolis was audited twice by two separate firms, but still suffered a re-entrancy attack.
This sort of attack occurs when a smart contract’s backdoor is left ajar. The contract’s state – which records how many tokens the contract has, among other things – fails to update quickly enough when tokens are removed, allowing the attacker to move more coins out than okay. It’s not dissimilar to a lazy bank teller continuing to fork over funds from an overdrawn account.
Combining audit redundancies with insurance is a step at least one major cryptocurrency investment firm is now urging.
“We are recommending our portfolio companies to get multiple audits from more than one provider,” Paul Veradittakit, partner at venture capital firm Pantera, said in an email. “We also think that projects and investors may want to buy insurance to protect themselves.”
It’s also notable that none of the top DeFi projects have suffered oracle attacks spurred by flash loans, dYdX founder Antonio Juliano told CoinDesk in a message. Many flash loans used in attacks have originated on his platform, which offers the product without a fee.
He said that “there’s a big divide between the well-engineered projects and others;” a divide being fleshed out in real time by flash loans.
“In the same way you wouldn’t blame Ethereum for an implementation detail of the chain being used for an attack, the way flash loans are being used in exploits is the fault of developers building insecure applications, not the flash loans themselves,” Juliano said.
Opyn Upgrade Aims to Add Capital Efficiency and Liquidity to DeFi Options Market
Published
13 Minuten ago
on
Dezember 29, 2020
By
Opyn, a marketplace for decentralized finance (DeFi) options, has rolled out a host of new features in its updated protocol that aim to make the crypto options markets more efficient and liquid.
While Opyn entered DeFi with an insurance-like product for governance tokens such as compound, its focus has since pivoted to the options market in the digital asset space. According to Zubin Koticha, co-founder of Opyn, the pivot is driven both by user interest and by the sort of hurdles decentralized finance currently faces.
“The biggest issue with DeFi is that[in]traditional finance, you don’t need super over-collateralization,” said Koticha. He added that the differing requirements on capital also eat into DeFi’s competitiveness with traditional finance.
Put simply, options are financial contracts that give users the right to buy or sell an underlying instrument at a predetermined price on or before a specific date. Depending on what they make of market trends, options allow traders to bet on the future bullish or bearish nature of the market.
While options have long existed in traditional finance they are relatively new to the crypto space and hence come with their own hurdles.
Koticha pointed out that under Opyn’s earlier version users needed to put up 100% of the strike price, the agreed-upon price for the option, as collateral in order to mint and sell one. This differs from traditional options markets where the requirements can be significantly lower.
According to Opyn, the update will add a host of new features to its options marketplace, including cash settlement for options without the need to exchange underlying assets, the ability for yield-earning assets to be used as collateral for options, and margin improvements for options.
“We changed our system from physical settlement to cash settlement,” said Koticha. Noting that while traditional markets also cater to needs to settle options in physical commodities like grain, he said there is no such physical delivery need in the crypto space and hence little need to actually exchange the asset. Instead, only the difference in price needs to be delivered.
Although the overall thrust of changes at Opyn are geared toward added efficiencies in how decentralized finance handles capital, the changes are only part of the upgrades in the pipeline. Koticha said Opyn is also plotting a protocol upgrade that will add the functionality to net short and long options together, thereby freeing up more capital.
Earlier in August, Opyn discoveredf a vulnerability on its platform when attackers were able to exploit a bug and walk away with $370,000. According to report by Cointelegraph, the bug allowed attackers to double-spend Opyn’s oToken and thereby steal the collateral put up by users.
In response, Opyn laid out in a blog post a set of measures it would adopt to prevent another such exploit and also compensated users affected by it. According to Koticha, the platform has continued to build on its security by performing additional audits and adding a functionality to pause the system.
While a central kill-switch seems counterintuitive to the ever-bustling crypto markets, Koticha said that with plans to launch a governance token in the future Opyn wants to transfer the kill-switch controls to decentralized governance for the long run.
Grayscale’s AUM Hits $19B, Up from $16.4B Announced Week Ago
Published
58 Minuten ago
on
Dezember 29, 2020
By
While it may be too early to project the possible performance of Grayscale in 2021, the spate of patronage the company recorded in the last two quarters of 2020 looks quite inspiring.
In what confirms the continued embrace of Bitcoin (BTC) and altcoins by institutional investors and the big-money clients, Grayscale’s total Assets Under Management (AUM) has been reported to top $19 billion, a significant uplift from the $16.4 billion reported a week ago. According to a report by CoinDesk, Grayscale hit this AUM milestone on December 28, and Grayscale’s Bitcoin Trust holds by far the largest chunk of the total assets at $16.3 billion.
The recent rally of Bitcoin to new highs as recorded in the past days started as a chain reaction that took its precedent months ago when Wall Street firms and institutional investors began betting big on Bitcoin. The investment made by the likes of MicroStrategy Incorporated (NASDAQ: MSTR), Square Inc (NYSE: SQ), and PayPal Holdings Inc (NASDAQ: PYPL) did not just help put Bitcoin in the limelight through mainstream media, it also prompted the embrace of the digital assets by other firms.
With this chain reaction, the price of Bitcoin continued to soar in response to boosted demand for the coin, and institutions like Grayscale that serves institutional investors benefited from this new demand, and hence, the continued increase in the firm’s AUM. Besides BTC, Grayscale’s Ethereum (ETH) AUM is now worth $2.1 billion, while the bulk of smaller holdings in Litecoin (LTC), XRP, and ZCash amongst others helped Grayscale’s total AUM to reach the new milestone.
Grayscale’s AUM May See More Boost in 2021
While it may be too early to project the possible performance of Grayscale in the coming year 2021, the spate of patronage the company recorded in the last two quarters of 2020 makes the case for improved performance provided the tempo is sustained.
Just as has been noted earlier, the continued embrace of cryptocurrency assets by highly liquid companies will continue to have a positive reaction on the price of Bitcoin, and by extension, this will even make more people pick interest in BTC. As a relatively young asset class, Bitcoin and altcoins have tremendous room to grow as the adoption rate is still not optimized owing to certain regulatory provisions in most countries, Grayscale and other hedge funds have enough room to compete for new clients entering the space.
With Grayscale been among the institutions at the forefront of helping to drive the acceptance of BTC, ETH, and other digital currencies, enjoying the dividends of its works through impressed AUM figures does not come as much of a surprise.
next Altcoin News, Bitcoin News, Cryptocurrency news, News
Benjamin Godfrey is a blockchain enthusiast and journalists who relish writing about the real life applications of blockchain technology and innovations to drive general acceptance and worldwide integration of the emerging technology. His desires to educate people about cryptocurrencies inspires his contributions to renowned blockchain based media and sites. Benjamin Godfrey is a lover of sports and agriculture.