A comprehensive interpretation of flash loans: why flash attacks will become the new normal?
Editor's Note: This article comes fromChain news (ID: chainnewscom)Editor's Note: This article comes from
Chain news (ID: chainnewscom)
, author: Haseeb Qureshi, managing partner of Dragonfly Capital, a cryptocurrency venture capital institution, reprinted with authorization by Odaily.
Flash loans have recently become a hot topic of concern from the outside world. Two hackers used flash loans to attack the margin trading agreement bZx. The first arbitrage amount was 350,000 US dollars, and then they engaged in a replica attack with an arbitrage amount of 600,000 US dollars.
If one word were used to describe these attacks, it would be "spectacular". In each attack, the penniless hacker loaned hundreds of thousands of dollars worth of ETH, dispersedly used a series of loopholes in the chain protocol to carry out a single operation, withdrew hundreds of thousands of dollars from the stolen assets, and successfully blocked The huge ETH loan hole. All of this is done instantaneously, that is, in one Ethereum block.
image description
When news of these attacks first broke, I was thinking carefully about the security issues of flash loans and DeFi. I think this question deserves a public discussion.
What is a flash loan?
Just to state my opinion briefly: I think flash loans present a significant security threat. But flash loans will not disappear, and we need to seriously consider its impact on the security of DeFi in the future.
secondary title
What is a flash loan?
The concept of flash loan was first proposed by the Marble protocol in 2018. Marble calls itself a "smart contract bank" and its product is a simple but smart DeFi innovation: risk-free loans completed through smart contracts.
How can a loan be risk-free?
Traditional credit institutions face two risks when lending money. The first is the risk of default: If the lender absconds with the money, the credit institution will suffer. But the second is liquidity risk: If a lender makes too many loans at the wrong time, or if borrowers don't pay back on time, the lender could unexpectedly run into a liquidity squeeze and be unable to meet its obligations.
Flash loans mitigate both of these traditional lending risks. The basic working principle of flash loan is: loan the amount needed by the borrower in a single transaction. However, at the close of the transaction, the borrower must repay no less than the loan amount. If the borrower can't, the lender automatically rolls back the transaction. (Yes, smart contracts can do that!)
Simply put, flash loans are automatic: if the borrower fails to repay the loan, the entire transaction is rolled back as if the loan had never occurred.
Something like this can only happen in the blockchain. For example, you cannot do flash loans on the BitMEX exchange. Because the smart contract platform processes transactions in one go, all elements of a transaction are executed in batches. Think of this as the "freeze time" of the transaction when the transaction is executed. In the centralized exchange, there may be fierce competition, which may cause some of your transactions to fail; in the blockchain, you can guarantee that all your codes are executed line by line.
Flash loans are different. There is no risk on the flash loan interest rate, and no opportunity cost! Because the borrower "freezes time" during the flash loan process, the system's funds are never at risk, never blocked, in the eyes of anyone else, and therefore you earn no interest (eg, it has no opportunity cost).
This means that becoming a flash loan lender feels like it costs nothing. This is seriously counterintuitive. So what should be the cost of a flash loan in equilibrium?
Basically, flash loans should be free of cost. Or more precisely, a small fee that compensates for the three lines of code added to make an asset lendable.
By Remco Bloemen, 0x Developer
Flash loans cannot charge interest in the traditional sense, because the duration of the loan is 0, (APR * 0 = 0). Of course, if any lender charges higher interest rates, it will be crushed by other competitors with lower interest rates.
Flash loans make money a real commodity. This kind of competition inevitably drives down the cost to zero or a very small amount in the end. dYdX currently has a lightning loan fee of 0. And AAVE charges 0.09% of the principal as interest. I don't expect this to last, in fact the AAVE community has started calling for 0 interest. (Note that neither of the two hacks we mentioned earlier chose to get flash loans from AAVE)
secondary title
The initial marketing label of Flash Loan was mainly for arbitrage transactions. Marble's debut statement stated:
"Flash Loan can help traders take a loan from Marble Bank, buy tokens on a decentralized exchange DEX, and then sell tokens at a higher price on another DEX. An automated transaction can allow you to earn arbitrage income in the bag."
And that’s the reality — by the amount, most of the flash loans we’ve seen so far have been used for these types of arbitrage transactions.
image description
AAVE's flash loan usage, source: AAVE
But the amount is still small. AAVE has issued just over $10,000 in flash loans since its inception. Compared with the scale of arbitrage transactions and the liquidity of the DeFi market, it is just a drop in the bucket.
This is mainly because most arbitrage transactions are done by competitive arbitrageurs running sophisticated bots. They conduct an on-chain priority gas auction, and then use GasToken to optimize transaction fees. This market is very competitive and they are happy to keep some tokens on their books to optimize profits.
On the other hand, the cost of borrowing from AAVE is about 80,000 gas and charges 0.09% of the principal, which is too high for arbitrage competition with meager profits. In fact, in most AAVE arbitrage transactions, the borrower pays more fees to the loan pool than the arbitrage income.
As it turns out, there are other more compelling use cases for flash loans in DeFi. An example is refinancing a loan. For example, let's say I have a Maker Collateralized Debt Position (CDP) with $100 of ETH locked in it, and I take out a loan of 40 DAI out of it, so my net position in the CDP after subtracting the debt is 60 Dollar. Suppose I want to refinance and put it on Compound in exchange for a higher interest rate, usually I need to buy back 40 DAI to close the CDP, which requires some upfront funds. Instead, I can use the flash loan to borrow 40 DAI to close the CDP, deposit $60 of unlocked ETH into Compound, convert the remaining $40 of ETH back to DAI through Uniswap, and use it to repay the flash loan. All in one, automated zero-cost refinancing.
This is amazing! This is a great example of Capital Lego at work. 1x.ag actually built a margin transaction aggregation application, using flash loans to automatically realize such transactions.
As cool as this is, the bZx attackers show us how much damage flash loans can do.
secondary title
The Significance of Lightning Attacks for Security
I believe more and more that what the flash loan really unlocks is the lightning attack-the use of flash loans to carry out high-value attacks. The recent bZx hack has given us a glimpse, and I suspect this is just the beginning.
Why flash loans have become a weapon for attackers? There are two main reasons.
Many hacks require large amounts of upfront capital (such as manipulating Oracle coin prices). If your $10 million in ETH is making a positive return, it shouldn't be an arbitrage trade.
Short-term loans can minimize the attacker's taint. If I had an idea of how to manipulate oracle coins with $10 million in ETH, even if I had that much ETH, I probably wouldn't want to risk my own funds. My ETH may be tainted, the exchange may reject my deposit, and the difficulty of money laundering is greatly increased. risky! But who cares if I take out $10 million with a flash loan? All parties will benefit. My lending source - dYdX's collateral pool will not be polluted, dYdX's pollution is somewhat gone.
You may not like it, but exchange censorship is part of the blockchain security model these days — pretty obscure and centralized. But I think flash loans essentially change that risk for an attacker. In the Bitcoin white paper, Satoshi Nakamoto issued a famous declaration: Bitcoin will not be subject to security attacks because:
"[The attacker] should find it more profitable to play by the rules than to destroy the system, which destroys his own assets."
In Flash Loan, the attacker has no interest in the Flash Loan game. Flash loans fundamentally change the risk for attackers.
Of course, attackers can't attack these protocols with just a lot of money. If all DeFi stacks are as secure as they claim to be, this shouldn't be a problem - which protocol is insecure against rich whales? You could argue that those agreements don't take that into account, they're just negligent.
However, it is claimed that Ethereum itself can be 51% attacked** for less than $200,000 per hour. This amount is not very large! If Ethereum's own security model can only protect against attackers with little money, why should we be so harsh on those DeFi applications that cannot prevent $10 million attacks?
(**Just to clarify, I personally don't believe this number, which ignores the impact of ETH shortages, etc., but it shows a train of thought.)
secondary title
How to slow down lightning attacks?
Suppose you are a derivatives platform and want to avoid lightning attacks. It is natural to ask: Can I detect whether the user I trade with is using flash loans?
The simple answer is: you can't.
The way Ethereum's EVM is designed doesn't allow you to read storage from any other contract. So if you want to know what happened in another contract, it can only be told by that contract. If you want to know if a customer is using a flash loan contract, you have to ask about that flash loan contract. Many current lending protocols are unable to respond to such queries (and in general, there is no way to force Flash loan lenders to do so).
Even if your derivatives platform tries to check for known flash loan protocols, it is easy for any such query to be misleading if the protocol platform uses proxy contracts or links across flash loan protocols. It is often impossible to tell whether a user is using flash loans at all.
In just one second, if someone wants to knock on the door of your trading platform with 10 million US dollars, it is impossible to judge whether it is their own funds or a flash loan.
So we have to protect against lightning attacks, what are the real options? I can think of three ways.
Convince flash loan protocols to stop offering this service
Just kidding. Guys, this is the crypto world!
In all seriousness, trying to get lending pools to stop offering flash loans is like trying to stop noise pollution, a classic tragedy in the public domain. It is in the interest of each protocol to offer flash loans, and its users have legitimate reasons to want to use this feature. Therefore, we can safely eliminate this option. Flash loans are not going away.
Force critical transactions to span two blocks
Remember, flash loans allow you to borrow capital within the time of a single transaction. If a capital-intensive transaction needs to span at least two blocks, and the user needs to withdraw the loan for at least two block times, lightning attacks become impossible. (Note: for this to work, user value must be locked between two blocks to prevent it from repaying the loan. If you don't design it correctly, users can flash attacks between two blocks)
Obviously this is done at a significant sacrifice of user experience: it means transactions will no longer be synchronous, much like the commit/reveal scheme. The user experience sucks and requires careful consideration.
Many developers complain about the asynchronous operation of smart contracts, such as interacting with Layer 2 or Ethereum 2.0's cross-shard communication protocols. Ironically, asynchronicity makes these systems more secure from lightning attacks. Because the attacker cannot synchronize the operation of the main chain and Layer 2 or shards in an automated transaction. This means that ETH 2.0 shards or Layer 2 DEXs will not suffer lightning attacks.
An on-chain proof is required to prove that the user's account balance has not changed after completing the flash loan
If there is some way to detect what a user's actual balance is (i.e. what their balance is before they take out a loan and after they repay it), we can defeat lightning attacks.
There is no way to do this in the native EVM mechanism, but it can be modified. What you do is: before a user interacts with your protocol, you require them to provide a Merkle proof that at the end of the previous block they had enough balance to repay the funds currently being used. You need to track this for every user in every block. (Thanks to Cornell professor Ari Juels for outlining this approach to me)
This approach works to a certain extent. Of course, it's still very rough, and there are some problems: verifying these on-chain proofs is extremely expensive on-chain, and no normal-thinking user would want to provide such proofs and pay gas fees for the entire process. In addition, users may have legal and reasonable reasons to adjust their balance in the last block. So, while this approach works in theory, it's not a viable solution.
Clearly, none of the three solutions I've listed above are ideal. I believe there is no real good solution for lightning attacks. But there are two specific applications that do slow lightning attacks: market price oracles and governance tokens.
On-chain governance will bring a series of headaches. On-chain governance is usually determined by weighted voting by governance token holders. But if this governance token enters a loan pool, any attacker can steal a large number of votes and get the result he wants.
Of course, most governance protocols require these governance tokens to be locked during voting, making lightning attacks useless. But this is not the case with some governance protocols, such as "Carbon Vote" and Maker's executive voting. Under the shadow of a lightning attack, these governance mechanisms are entirely possible to be compromised.
Ideally, you don't want governance tokens to go into flash loan pools. But this is not determined by the coin issuer, it is determined by the market. Therefore, all governance actions should require a token lock-up period to prevent lightning strikes. More critically, all governance tokens must have timelocks. Timelocks force all execution decisions to have a waiting period before they take effect. (eg Compound's timelock is 2 days). This mechanism allows the system to have fault tolerance time in case of unexpected governance attacks. Even though MKR is currently largely excluded from flash loan pools, it has recently been claimed that MakerDAO is vulnerable to such attacks. MakerDAO is currently expediting the fix.
secondary title
What is the profound significance of these?
I think the bZx attack completely changed the situation.
This won't be the last lightning attack incident. The second bZx attack is just a replica of the first, and I suspect there will be another wave of similar attacks in the coming months. There are now thousands of bright teenagers in every corner of the globe poring over all this DeFi Lego, microscopically looking for any loopholes, trying to figure out how to launch a lightning attack. They also make hundreds of thousands of dollars if they exploit a single vulnerability, which is life-changing sums for most of the world.
In the end, these events got me thinking about an ancient concept in the crypto world: Miner Extractable Value (MEV). MEV refers to the total value that miners can extract from a blockchain system, including block rewards and fees, but also other less aboveboard benefits, such as transaction reordering or inserting rogue transactions into blocks.
Fundamentally, all of these blitz attacks should be thought of as a single transaction in a massive mempool of funds. For example, the second bZx attack generated $645,000 worth of ETH profits in a single transaction. If you're a miner and you're about to start mining a new block, imagine looking at the previous block's transactions and saying to yourself, "What's going on here? The last block contained $645,000 in profit, why should I mine?" A new block for $500?"
It is in your better interest not to keep mining new blocks, but to try to rewrite history and make yourself that lightning attacker. Think about it: this transaction is equivalent to four hours of honest mining on Ethereum! This is the same principle as having a superblock that contains 1000 times the normal block reward - the logical outcome of such a superblock is a frantic scramble by large groups of miners to steal that superblock for themselves.
image description
Simulation shows fierce competition among miners
In equilibrium, all lightning attacks should eventually be mined to extract value. (Note they should and will eventually steal all on-chain arbitrage and liquidations). Ironically, this would be an important element in thwarting lightning attacks, since it would prevent hackers from cashing in on their theft. Maybe eventually miners will start offering private bounties for exploit code, providing tipster fees to hackers. Technically, utilizing zero-knowledge authentication can be done without trust. (Isn't it weird to think so?)
It's still science fiction today. The miners clearly didn't do that.
Why didn't they do it? There are countless reasons. First of all, it is difficult and requires a lot of work. EVM is difficult to simulate, and the risk is very high. There are loopholes that may cause fund loss or orphaned blocks, which will attract criticism. The entire mining pool will encounter a public relations crisis and may be listed as "Ethereum public enemy." In the current situation, miners are more likely to incur more economic losses and orphaned blocks if they do so, rather than get the money.
That's true for now, but it won't be the case for long.
This has brought a new impetus to Ethereum to transition to Ethereum 2.0 as soon as possible. DeFi on Ethereum, as amazing and fascinating as it is, is undoubtedly full of holes. DeFi is unstable on PoW chains because all high-value transactions are redistributed by miners (also known as time bandit attacks).
For a system to operate at scale, what you need is immutability - miners cannot rewrite confirmed blocks. This will protect previous blocks from reallocation. Plus, if DeFi protocols exist on separate Ethereum 2.0 shards, they won't be vulnerable to lightning attacks.
