Risky Business: DeFi, Ethereum will continue to grow
Editor's Note: This article is from:Ethereum enthusiasts (ID: ethfans)Editor's Note: This article is from:
Ethereum enthusiasts (ID: ethfans)
Ethereum enthusiasts (ID: ethfans)
, Author: Taylor Monahan, translation & proofreading: Zeng Mi, Anzi C1int & A Jian, reprinted with authorization by Odaily.
Editor’s Note: The author of this article calls on DeFi projects to carefully examine the project’s security model and to be honest and fully inform users of the security risks involved. Considering the actual writing time of this article (before the ETHDenver event in February), the author's warning that the DeFi field has fallen into a frenzy is prescient. The bZx attack occurred during the ETHDenver event, and later the Curve project also seemed to have some problems. The attack is over, but the DeFi story is not over, nor should it be. In order for DeFi to mature, it is also time to take a good look at the author's outcry in this article.
I don’t know if you’ve seen Risky Business, a coming-of-age movie starring Tom Cruise. In the play, he is involved in a series of troubles after his parents leave home. He must solve the problems himself, but this only creates more troubles. What makes this journey endearing is that the baby-faced Tom Cruise is so innocent and never idle. Had he been any older or more childish, his choices would have been too irresponsible for anyone to forgive.
There are many similarities between the cryptocurrency industry and this movie. We avoid many things that should be confronted head-on, and refuse to learn from past mistakes, and even refuse to admit that smart contracts are not completely trustworthy. Wait until you really mess things up, and then use idealism and immaturity to prevaricate others.
But naivety does not reduce risk, and over time the rhetoric will no longer be acceptable. If we really want to be respected by people instead of losing face, we should stop acting like this to cover up the real risks in the industry.
- "Those who forget history will repeat it." -
Never forgetting the past is the teacher of the future, but if you don’t learn the lesson and forget it after seeing it, you will definitely repeat the same mistakes. That's the way it is, just study smart contract attacks and you'll see it's just the same attack repeated over and over again...
How can we really reduce the risk?
image description
- 1. Self-awareness 2. Vigilance 3. Gratitude 4. Paranoia -
In summary, we need a culture that reduces and mitigates risk by:
Vigilance: We should be vigilant and aware of risks before they lead to negative outcomes, whether they are risks to ourselves or those around us. We should also actively seek information to reduce the "unknown unknowns".
Paranoia: We should maintain a deep level of fear, paranoia and doubt. Otherwise, for a long time, we can only hope to pretend to be cute.
image description
- What is risk? -
first level title
Risk is the possibility that something bad will happen, the probability that things will not go as expected. When you expect something to happen — expect to make a fortune, save the world, or make an amazing product — then the exact opposite happens.
- https://nymag.com/intelligencer/ -
Risk is everywhere, and our ability to reason about risk is terrible.
image description
Lanier: What started as an ad morphed into a massive, ongoing process of behavioral intervention, where everyone was monitored by devices and swayed by carefully crafted stimuli. This terrible event has long been foreseen by science fiction writers, Philip K. Dick or "1984" directly depict such a scene. Despite all these warnings, we have stepped into a world where massive behavior modification mechanisms have been created under the rule of digital networks. And we do it because we want to be great socialists and great liberals at the same time.
We need to be aware of what might happen so we can try to mitigate the risks we face, even deep moral hazard. We don't want to connect everyone and create a new decentralized world as we imagined. In fact, we are creating a super efficient privacy invasion system, and everyone in the world is not immune to it.
image description
- all risks -
There are many types of risk. Some are unique to financial markets, while others are specific to cryptocurrencies and smart contracts.
The most interesting and scary thing about DeFi is that it combines the above two things that are inherently risky. We put them together, broke apart and crumbled, and then kind of got away with it and hoped everything was ok.
If you really want to have no problems, don't be lazy, you guys.
Whenever these systems are interconnected, dependent on each other, or stacked on top of each other, you are at great risk. We like to think of DeFi as "DeFi Lego", but if its foundations aren't solid, it's really "DeFi Jenga" and we'd all be bruised.
If a DeFi system that handles millions of dollars in user deposits can be upgraded, then you will be hundreds of thousands of dollars every second. If you're not already following Chris Blec on Twitter, do so now! He is doing a study to try to determine how these upgradeable smart contracts can guarantee security. Only rely on a private key? (This is to torture bZx, because they have committed to using a multi-sig governance solution in 2018.) What is protecting the code of the smart contract from being changed or controlled? And what is guarding the money? Most (we won't say all) of these DeFi smart contracts are upgradeable. And... PLEASE NOTE! People are also being trolled — even those who control complex smart contract systems.
The range of risks is so vast that we can hardly afford, let alone manage, them. Too many things threaten individuals, systems, and even these intertwined systems.
What do these risks mean for the DeFi ecosystem? How bad can it be?
first level title
February 15, 2020: Fulcrum / bZx
Well, around the time of my talk (February 15th, 2020, 9:50am CST) something bad happened, and people were still trying to figure out if it was an attack on a smart contract or a bug use. It is estimated that the attackers earned about $350,000 through some sophisticated means. Then, more details emerged and things got more complicated. Two days later, a similar attack occurred again, and this time the attacker made a profit of $650,000.
However, in my opinion, it doesn't matter whether the incident stemmed from a hack, exploit, vulnerability, or market manipulation. Anyway, something unexpected happened. And whenever the unexpected happens in financial markets, it's rarely a good thing. If that happens when one party makes $350,000, it usually means that the other party loses $350,000.
These attacks happen because certain #DeFi systems are interconnected, dependent and built upon each other in various ways. And when the bad guys combine positions on all these different platforms, they make a ton of money. However, behind some people's huge profits, others are suffering huge losses.
Stani from Aave retweeted the maven's message in Telegram, detailing what the suspected exploit was. Even though the analysis sounds sane, the ending still bothers me:image description。
- "However, if the above analysis is correct, then this does not sound like an attack at all. It is not a loophole in the contract - but a complex arbitrage/market manipulation scheme spanning 4 of the most well-known DeFi sites , not an attack.” Stani shared information, although he did not write it. -
Translator's Note: The bZx lightning attack incident can be seen from beginning to end
Analysis provided by PeckShield
Stop stop, this is ridiculous! "Our smart contract wasn't hacked! We didn't write bad code in an insecure way, it's just that our code was used to do insecure things!" Is this human?
That's why I say we need to be more diligent and paranoid, rather than using legalese as a shield, let alone trying to disguise reality with fancy words. Attempts to deflect responsibility technically or legally will not change the fact that what happened, nor will there be compensation for the victim. Instead, focus on creating safe and reliable products to prevent accidents and protect users' assets from loss.
[Note: It was later discovered that the attack was assisted by manipulating/exploiting the system, but the real breakthrough point was the error in the code itself. ]
- "Security is not only about whether the code works as designed, but also what attributes the product should be designed to provide users. The Ethereum community has excelled at the former and the latter due to the lucrative #DeFi What a mess. Just because your code works doesn't mean your system is safe." Source: Phil in a security Telegram group -
This is something we should all think about first, and I have nothing else to add.
Although we can learn a lot from this round of attack, considering that the bZx team was forewarned of this type of attack as early as September 2019, the lesson is too painful:
image description
Sam Sun — a security researcher, white hat, and brilliant smart contract hacker — wrote an article about DDEX and bZx (aka Fulcrum) in which he examines how to manipulate the feeds they depend on. What are the consequences of the pricing method. (To clarify: He responsibly disclosed the vulnerability to the appropriate teams and assisted them in the fix, just as he has helped 0x, Curve, ENS, Kyber, Cheeze Wizards, Livepeer, Authereum, and others Same. 🙇)
In particular, he looked at whether price data could be manipulated to induce a destructive response from a smart contract. Since these platforms all rely on price data from Uniswap and Kyber, an attacker who can cause a brief spike in price can take far more than they deserve from DDEX/bZx's smart contracts. And while this unintended act made some people rich, it also robbed others of their wealth.
Sam further offers some great advice for all smart contract developers:
- "Never use an on-chain decentralized oracle without rigorous verification." "Be wary of using dependencies on third-party projects" —— samczsun ——
We at MyCrypto deal with these kinds of dependencies on a daily basis. The JavaScript ecosystem relies heavily on npm, and every new dependency included in npm adds another 50 dependencies. It is impossible for us to audit all the content. Therefore, various attacks on cryptography products emerge in an endless stream. Just because you don't use a certain package.json in your product doesn't mean you don't depend on other package.json... These attacks have verified this.
image description
- "Similarly, before introducing a dependency on a third-party project, you should not only consider whether the project has been audited, but also whether its specifications and threat model are consistent with your own project. If you have time, it is best to Dig into their contracts." -
Just because we think or assume a contract is safe, doesn't mean there is no risk, as the contract can also be manipulated. And your contract could also be manipulated if it incorporates that. Any manipulation may endanger your system and users. The above case looks like someone manipulated four different DeFi platforms combined with each other to complete an epic attack.
image description
- "Just inputting an asset for exchange for the same asset can drain this female cicada in the pool without considering i == j. Anyone can do it." - samczsun -
Alright, now back to your original scheduled speech...
There is now a relatively new DeFi contract called Curve that has not yet been fully audited and deployed on the mainnet. Guess what happened?
I know that everyone wants to create amazing products, and I know that the current environment is very exciting. But let's face it. Deploying a smart contract on mainnet, letting it grow to $1 million, and expecting it not to be destroyed is arrogance, naivety, and ignorance. Not cute at all, and increasingly dangerous as the market grows.
While it is easy to blame the project team for making unsafe choices, others blame the community and Curve users, and the atmosphere in this circle: not asking questions, forcing the team to be transparent.
Layers of risk
image description
Take a look at how the risks stack up when you use these products.
Let’s say I’m just a normal guy who learns that it’s possible to earn 5%, maybe 8%, maybe even as much as 10% interest on “DeFi”! Then my assets can be leveraged by 2 times, 20 times, or 100 times? ! This is too amazing! So I pulled out my USD and went to buy ETH.
The process of exchanging USD to ETH is fraught with various risks. Holding cryptocurrencies is risky. Financial markets are also risky. You can also get phished or fall for a coin giveaway on Twitter.
- Various risks when exchanging ETH for USDC -
Since the price of ETH fluctuates too much, and I still want to enter the DeFi market to earn some passive income, I decided to exchange for some USDC. And the process of converting ETH to USDC again brings additional risks.
As a centralized stable currency, USDC needs to comply with relevant regulations, so its token contract contains a blacklist, so that its maintainers can freeze the tokens of certain addresses—when they think they should (or are forced to) ) when doing so.
image description
Pretend that the picture above is about exchanging USDC for cUSDC through Compound.
Now I want to deposit my USDC into Compound to earn interest. The contract returned me cUSDC tokens.
And this process, once again, introduces a whole new set of risks. You may lose your private key. Smart contracts can be manipulated or simply hacked. Once my USDC is deposited into Compound, I can only trust that I can get my USDC back and that the token contract and Compound contract are safe.
image description
- Various risks when putting cUSDC into ETHRSIAPY TokenSet -
I took out my cUSDC and put it into the ETHRSIAPY collection. Wow! #DeFi!
However, this process also introduces new risks! Its smart contracts can also be attacked. Someone may front run your rebalance transaction, causing you to lose money. Even if taxes are not considered, you still may not make money because the market moves differently than you expect.
The biggest problem is: at no time has anyone clearly informed me of these pitfalls. Unless I read the fine print and follow the DeFi community's twitter a lot, I'd lose everything and be left in the dark.
image description
-A condensed map of the various risks faced by the series of operations from USD to TokenSets. -
If we zoom out and look at the whole process again, it's full of risk. At present, the DeFi business that everyone is building in full swing is such a risky business model.
A series of operations in which users convert U.S. dollars into positions in the TokenSets application virtually integrates a variety of risks. This is why DeFi scares me. Risks in smart contracts, technology, cryptography, markets, finance, etc. overlap each other.
We should be afraid.
Apparently I just gave an example of USDC because their centralized "I can blacklist you!" approach is hilarious. But the elephants in the other room are Maker and Dai. I won't comment further on this, because everyone knows what's going on.
Whether they ignore or deny the potential risks, it shows that they lack awareness of the consequences of their operations. If someone builds a DeFi system and feeds you this theory, please cry for help before (or after) you turn around and run away. Be sure to tell everyone, be sure to stand on the roof and yell. In this rapidly iterative ecosystem, it is very necessary for people to know the latest developments, and this blind attitude is exactly what no smart contract developer should have.
This mentality is the most serious early warning sign at present, even more worthy of people's vigilance than the contract not being audited. Because the contract can be audited, but the team's attitude of blind confidence is difficult to change. Handing over money to a group of people who are so arrogant that they think they have built a perfect system is very dangerous, because they will most likely have serious disregard for the safety of users' funds.
Run away and don't look back.
image description
- "I'm sure Tay hates #DeFi" -
I've heard rumors that I hate DeFi. Let me clarify here: I don't hate DeFi. In fact, DeFi excites me more than disgusts me. But at the same time it scares me.
I think what we're doing has limitless potential. One of the visions of cryptocurrency is to allow people to use money that is not controlled by a centralized entity, and another vision is to allow "people without bank accounts to enjoy banking services." This means not only inviolable private property, but also better use of personal assets. When funds can be transferred efficiently, human society and the whole world will become better.
If we go out with only idealism and refuse to listen to the reminders of others, we will not be able to solve the problem at its root. Someone needs to point out the loopholes in our theory and contracts, so as to improve the robustness of the entire ecosystem and the possibility of success.
The reason I've built around this throughout the lecture is because I think there's great value in setting things right. I hope we are on the right path.
So, how to set things right? 👯♂️
image description
-1. Be aware of the risk 2. Reduce the risk 3. Mitigate the risk-
We first need to be aware of the risks.
Next, we should reduce risk. The source of risk is the attack surface of the system. The simpler the system, the lower the probability of error, and it should not depend on the external environment or system.
The next step is risk mitigation. If something goes wrong with the system (which is inevitable), how do we respond and mitigate the severity of the problem? Instead of losing 100 million, is there any way to reduce the loss to 100,000?
I've seen far too many poor handling of security incidents. People tend to focus on reducing risk, thinking that eliminating risk is the only work worth doing, but they forget to prepare for the worst in advance. We often ignore some detailed work, such as how to monitor system failures? How to determine that an accident has occurred? How to react quickly? How to minimize the loss?
Here I would like to mention a very good project - DeFi Score. Jordan Lyall and his team have done quite a lot of research work in this area, discovered the risk loopholes of various DeFi platforms, and developed a scoring system to help people understand whether the DeFi platform is safe and how risky it is.
These scores should help people better understand DeFi platforms. If we cannot clearly identify risks and discuss them thoroughly, users will not be able to understand the risks and make prudent decisions. Before people throw all their money into DeFi, they need to understand the risks of the platform, rather than letting these risks lurk under the glamorous appearance.
When I think about connecting DeFi products directly to MyCrypto, I can't help but think of the promises I made to users. Users trust us, should we imply how high the returns of these DeFi products are? If our goal is simply to attract more users, the answer is undoubtedly yes. But if we really think about users, then comparing these smart contract products that have only been online for a few months to banks is fucked.
image description
-Ether Deposited to The DAO-
image description
- Funds raised by ICOs in 2017 (USD) -
This picture is the data of ICO in 2017, and it is also crazy exponential growth, people are completely crazy. The amount of money invested in The DAO has actually warned of a rollover, but as the market turns from bear to bull, people don't realize that this is a problem. Like today's DeFi, The DAO was built by a group of old players with experience in cryptocurrency, but with the arrival of the next year's bull market, the industry has jumped from a total of 3 ICOs to 3 ICOs a day, and new leeks continue to enter the market.
image description
- Total assets locked in DeFi (USD) -
This picture is the current situation of DeFi, exactly the same hockey line.
About 6 months ago, I said that the lending market was never going to get frenetic. Today, I can be 100% sure I was wrong. The current DeFi platforms in the market have become frenetic and will become even more frenetic in the future. We will see new people entering the market and depositing a lot of money into DeFi.
Whether you're twittering, writing pitches for your product, or hesitant to put unaudited smart contracts directly on mainnet, I hope you think about the blindness of people during The DAO and ICO mania . We should help the new DeFi players who are running into the market as much as possible, instead of calculating how much money they have to lose. Not only users need to be educated, but developers as well. Our ecology needs higher-level services and security. Think about the accidents that happened in the ecology, and don't repeat the same mistakes.
In the end, you need to take responsibility for yourself, your team, your employees, your peers, your community, and your ecosystem. If you mess around irresponsibly, the consequences will be shared.
Everyone should be on high nerves at this point, it's something that should scare you. Fear can motivate people to make responsible decisions.
first level title
But honestly, what can we do?
The first thing we need to do is discuss it openly.
We want to ask tough questions.
We need to engage in honest discourse.
We need positive feedback for the cause of our faith.
We need to ask questions publicly, not in Telegram groups or private messages.
We need to be skeptical.
We need to encourage skepticism in the industry. When I first got into Bitcoin, our belief was: no one can be trusted. Human nature is inherently evil, so we must remain skeptical and vigilant. Even trust, but verify (Trust, but verify). Valuable assets like accountability and transparency have been quietly lost.
Finally, I would very much like to have more open forums. Pushing things into Telegram groups is pretty bad. People can't use Google to find relevant discussions, and people can't find valuable insights from Telegram. Even if you participate in a conversation, there is no way to keep track of the discussion. At the same time, the news cannot become a historical experience worthy of reference in the future. One of the biggest benefits of The DAO incident is that we can go back and see how we thought at the time. We can learn a lot from people's attitudes before, during, and after The DAO. This is valuable. (Translator's Note: Is it a bit like we are always discussing in WeChat groups?)
Second, we need to ensure security and education while encouraging sharing. The security I am talking about here refers to all aspects:
Safer smart contracts.
Better research and tools.
Comprehensive auditing and formal verification.
Upgradability and key management. (Not only the user's key management, but also the administrator module in the smart contract)
But in case you screw up, be transparent and open with the community. Tell everyone what happened, how you realized something bad happened, how you screwed up, what assumptions you made, etc. Allow others to learn from your failures. Now that you have failed, the only way to make up for it at this time is to share your experience and help others not to make the same mistakes.
Finally, we need more care and understanding. It's easy to get aggressive in cryptocurrency circles, but being assertive isn't the same thing as being domineering.
There is no time to reply to someone with "Okay, bigot", especially if they just lost money. It's picking and slandering and making us all look like assholes.
Such rhetoric should never be used any longer.
- “ #FOMO >It’s you who didn’t inform them of the risks, it’s you who kept bragging about your product on Twitter, it’s you who kept telling everyone that the product has no bugs, it’s as good as pie falling from the sky. When an accident happened when they did what you said, how dare you insult them with a shy face. This behavior is simply outrageous.
image description
everything"-
I'm serious here. Please do not underestimate the power of #FOMO. Don't underestimate the power of greed. It drives reasonable people to do irrational things and hurts everyone's careers. So please be vigilant.
first level title
ad insertion
In the past six weeks, the price of ether has increased by about 115%. Traffic to beta.mycrypto.com, mycrypto.com, and our knowledge base site increased by 68%, 75%, and approximately 130%, respectively.
Pretty crazy, right? What does this mean?
First, it means that people are not browsing beta.mycrypto.com properly.
Second, it means the user is asking for help. We observed a much higher increase in traffic to the Knowledge Base page than to the actual product. The most viewed article is "How to Buy Ether." This means new people are coming and we need to export more resources to help them. Whether it's a tutorial for beginners or something deeper, please share your knowledge without reservation.
If your product was released after January 2018, you're probably fully immersed in the wonders of this space. My suggestion is that you should learn from the mistakes of the past, read and absorb as much material and information as possible. By the way, you should also hire technical support personnel early, because if something goes wrong, it will be too late to find it.
For newcomers: You should be intimidated and suspicious, but don't be intimidated by this lecture.
Experiments have value, but they should be conducted in a safe manner. There are already several testnets on Ethereum. You can limit the number of contracts, first internal test and then public test. You can develop contingency plans in advance. Have fun developing, but not so much fun if you lose everyone's money.
Finally, veterans in the industry, you have been deeply involved in The DAO incident and ICO mania before. I hope you can share your wisdom, knowledge and experience, and tell everyone what you have gained over the years without reservation.
This knowledge needs to be shared, especially with newcomers. When you feel like there's too much fanaticism in the arena or something is wrong, the best thing to do is to speak out.
