Hardcore decryption of friend.tech: In-depth analysis of FT’s operating principles and risks
Original author: 0xKing (Twitter:@0xKingJ）
Original source:Kings chat
Odaily Editors note: friend.tech has developed rapidly recently. For example, it generated 2,953 ETH (approximately US$5 million) in fee income in just 11 days, and the current total value of user shares reaches 4,435 ETH (approximately US$7.4 million). . However, the project also has some problems, including data leakage through the API, and the ability to buy and sell shares from the contract without an invitation code. Judging from the contract code, the invitation code and application have no effect on the contract. Users can directly buy and sell on Etherscan by linking MetaMask.
Yearn core developer banteg tweeted that the leaked database showed that 101,183 people gave friend.tech permission to post as them. Yu Xian, the founder of SlowMist, retweeted that the friend.tech wallet addresses corresponding to more than 100,000 Twitter accounts were leaked. These wallet addresses can be associated to the upper layer at will, and more privacy can be obtained.
Afterwards, friend.tech responded to the query and stated that the situation described in the relevant reports was just someone crawling its public API, showing the correlation between the public wallet address and the public X (formerly Twitter) username. Talking about a data breach is like talking about someone attacking by looking at users public information on X.
How did friend.tech, which is rapidly becoming popular, create this social influence game? What are the potential risks behind the popularity that cannot be ignored?
This article has a certain reading threshold, readers need to understand the basic Dapp implementation method, and have some understanding and experience of Friend.tech. Without any investment advice and bad guidance, it is only used as a technical discussion.
overview
Friend.tech cleverly blends decentralized finance (DeFi) and social networking to create a unique social influencer game. In this experiment, you can not only interact with your friend, but also vote with your feet for him.
The project party can be described as a strategic master in marketing and communication. They are not only good at hunger marketing and viral communication, but also have a deep understanding and rich practical experience in decentralized finance (DeFi). It is based on this background and advantages that they cleverly built social relationships into a dynamic and liquid automated market maker (AMM) market.
The cold start of the early project was very simple. During the crazy transactions on the base, it caused an abnormality in the data on the chain and attracted some attention. With the entry of OGs such as Cobie, social networks became popular.
The design of the product mechanism is not only innovative but also shows high potential for practical application. In the long run, this could change our conventional understanding of social networking and financial interactions. But at the same time, because of its simple and crude implementation, it brings a lot of problems to the privacy of users.
Novel experimental point
Tokenize social network
What happens when you buy or sell shares?
1. KOL needs to purchase his first share before others can purchase it. The act of purchasing is equivalent to using ETH to add liquidity to the KOL’s share. Liquidity is stored in the contract as a data relationship. (No tokens appear in this process, only liquidity is constructed in the function of the smart contract)
2. The data relationship is stored in the contract, that is, which wallet the share purchased by the user belongs to, and the purchased quantity. The centralized server records this relationship synchronously by monitoring the transaction events on the chain.
Take an example to expand the entire liquidity change:
The current share buy price of Cobie = 1.0080625 ETH. You spend 1.0080625 ETH to buy it. At this time, the liquidity added to the pool (90%) is 0.90725625 ETH, and 10% is collected by friend.tech and KOL.
After you buy, the buy price increases, the new buy price = 1.024 ETH, but the sell price at this time = 0.99225 ETH,
If you sell immediately (that is, just buy and sell), then when you sell, although the marked price is 0.99225 ETH, you can actually only receive 90% of the selling price, which is 0.893025 ETH. The same , 10% is charged by friend tech and KOL.
In other words, with this operation, you will lose -0.115038 ETH, all of which will be donated to Friend tech and KOL...
Product Features
1. Invite only
In the current beta version, users can only register through invitation codes, hunger marketing, similar to clubhouse back then.
2. PWA to Mobile Only
Users can only use Friend tech on mobile web pages
Friend tech uses the long-dusted technology PWA (learn more here). Dapp does not support PC use and can only be used on mobile phones, and requires PWA (that is, the mobile browser adds the current web page to the home screen) before the user can Enter the product registration process.
3. self-custodial wallet
Each new user registration automatically generates an EOA wallet for the user, and the private key can be exported. Use privy.io as wallet provider
4. Holders chat room
Each persons chat room is divided into two categories:
I am a homeowner, and all the people who bought my share are in the same chat room
I am a guest. I buy a share of a specific person and then join that person’s chat room. After I sell the share, I no longer have the right to enter.
Game Arbitrage Strategy Game Strategy
Liquidity model:
Since there are no Automated Market Makers (AMMs) for each KOL’s shares, the share price is calculated using the following bonding curve formula (this formula was invented by Friend tech himself):
y = x^ 2 / 16000
in:
- y represents the price in ETH.
- x represents the total share supply at the current moment.
Profit model:
For details, seethis form(Highly recommended to open it and take a look).
arbitrage strategy
Go back to the first example to expand the entire profit change:
The current share buy price of Cobie = 1.0080625 ETH, you spend 1.0080625 ETH to buy, at this time the liquidity (90%) added to the pool is 0.90725625 ETH, 10% is collected by friend tech and KOL.
After you buy, the buy price increases, the new buy price = 1.024 ETH, but the sell price at this time = 0.99225 ETH,
If you sell immediately at this time, then when you sell, although the marked price is 0.99225 ETH, you can only receive 90% of the selling price, that is, 0.893025 ETH. Similarly, 10% is charged by friend tech and KOL .
In other words, with this operation, you will lose -0.115038 ETH, all of which will be donated to Friend tech and KOL...
This means that if you want to arbitrage, you must wait for the price to be high enough, that is, after you, there will be new buyers entering the market, so how many buyers are there? According to the calculation in the model, it can be found that in this example, your buying position is at 127, until the total number of shares reaches 135, a maximum of 8 people will enter the market again, and you will start to make a profit when you sell, with a profit of 0.00196 ETH. Before that, you Selling is a loss.
This is a conclusion based on the profit rules based on the profit model. The profit is affected by the relationship between the buying position and the total number of shares:
When the buying position is between 1 and 18 (that is, when the buying price is less than 0.02025 ETH), the total number of shares = buying position + 2, and profit begins;
When the buying position is between 19 and 36 (that is, the buying price is between 0.02025 ETH and 0.081 ETH), the total number of shares = buying position + 3, and profit begins;
When the buying position is between 37 and 55 (that is, the buying price is between 0.081 ETH and 0.1890625 ETH), the total number of shares = buying position + 4, and profit begins;
When the buying position is between 56 and 73 (that is, the buying price is between 0.1890625 ETH and 0.3330625 ETH), the total number of shares = buying position + 5 will start to make a profit;
......
Privacy Risks and Scams
Privacy issues:
Twitter user’s on-chain wallet address leaked
Detailed analysis:
1. The relationship between Twitter ID and user wallet of Friend tech is exposed. Friend techs query API is public and directly exposed on the website. Anyone can query the users Twitter and the address of their Friend tech wallet through the API query
2. The address of the Friend tech wallet and the user’s original wallet on Ethereum were exposed. Because most Friend tech wallets are entered by users through their own wallets in Ethereum for cross-chain transaction transfers, by indexing cross-chain transaction information, all user wallets that have recharged Friend tech will be exposed.
Below is a flowchart of the entire relationship hack. (Twitter user @0x foobar first discovered this vulnerability and conducted information mining. On this basis, 0x foobar developed a set of contracts and webpages, allowing users to directly purchase specific twitter from friend tech official contracts through their own contracts. User’s share and convert this share into ERC 20 tokens.)
Website made by foobar: https://friends-wrap-v-01.vercel.app/
Friend tech shares ERC 20 Factory contract address: 0x68250Bf6d105Fe33f3120C5AfF385160d54EB5F2
Fake Points Token Scam
Friend tech’s points are currently centralized, please don’t trust the tokens on the chain, they are all scams
2023/08/20 Fake FTP tokens have appeared on the chain:
https://basescan.org/token/0x15ee7ed4d18d2205967168ac5604ff50d54bbfeb (It’s fake, don’t be fooled)
Reference
https://www.coindesk.com/web3/2023/08/11/is-friendtech-a-friend-or-foe-a-dive-into-the-new-social-app-driving-millions-in-trading-volume/
https://www.privy.io/blog/friendtech-case-study
https://coinbay.io/en/what-is-friend-tech-a-guide-to-create-an-account-on-the-web-3-social-network-friend-tech-27306
https://web.dev/progressive-web-apps
