What are the lessons from the crisis after the DeFi mania? This flourishing message is worth revisiting

Original title: "View | Risky Business: DeFi, Ethereum will continue to grow" (Risky Business: #DeFi and Ethereum's Coming of Age Story) Written by: Taylor Monahan

The author of this article calls on the DeFi project to carefully check the project's security model and to inform the users of the security risks in an open and honest manner. Considering the actual writing time of this article (earlier than the ETHDenver event in February), the author's warning that the field of DeFi has fallen into fanaticism is prescient. The bZx attack happened during the ETHDenver event, and later the Curve project seemed to have some problems. The attack is over, but the story of DeFi is not over, nor should it be over. In order to make DeFi mature, you should also feel the author's shouting in this article.

This article is based on a speech I gave at ETHDenver in February 2020.

• Government of India, central bank and SEC to discuss cryptocurrency regulatory framework
• Coinbase: Bitcoin's correlation with traditional markets is temporary
• Xinhuanet article talks about new infrastructure: Blockchain will become a basic production tool like water and air in the future

I wonder if you've seen "Risky Business", a growth movie starring Tom Cruise. In the play, he was involved in a series of troubles after his parents left home. He had to solve the problems by himself, but this would only cause more troubles. The reason why this journey is so cute is because A Tang, who has a baby face, is so naive that he hasn't been idle for a moment. If he is older or more naive, his choice is too irresponsible and no one can forgive.

The cryptocurrency industry has many similarities with this movie. We evaded many things that should have been face to face, we also refused to learn from our past mistakes, and even refused to acknowledge that smart contracts were not completely trustworthy. Wait until you really mess things up, and then use idealism and immature to fool others.

However, innocence does not reduce risk, and over time, this rhetoric will no longer be accepted. If we really want to be respected by people, rather than being indifferent, we shouldn't pretend to be stupid and cover up the actual risks of the industry.

Those who have forgotten history will eventually repeat their mistakes

Do n’t forget the past and learn from the past, but if you do n’t learn the lesson and forget it after seeing it, you will definitely repeat it. This is the status quo. As long as you study smart contract attacks, you will find that this is just the same attack repeated over and over again …

How can we really reduce the risk?

1. Self-awareness 2. Vigilance 3. Gratitude 4. Paranoia

All in all, we need a culture to reduce and reduce risk:

• Self-awareness: We should be aware of the impact of ourselves and our actions on those around us and the wider world.
• Vigilance: We should be vigilant and be aware of risks before they lead to negative results, both for ourselves and for those around us. We should also actively seek information to reduce "unknown unknowns".
• Awe: We should be in awe of the complexity of these systems and of the power we have and the impact we can have on the real people around us.
• Paranoia: We should maintain a deep level of fear, paranoia, and doubt. Otherwise, for a long time, I can only hope that the costume is cute.

What is risk

What is risk?

Risk is the possibility of bad things happening, that is, the probability that things don't develop as expected. When you're looking forward to something happening-looking to make a fortune, saving the world, or making an amazing product-then the actual thing is just the opposite.

Risk is everywhere, but our ability to reason about it is very bad.

I have read too much about the evolution of the Internet. The early Internet builders were really a group of over-optimistic idealists. Although we still live in the results they create today, they never imagined that Google and Facebook could have such great influence and control.

https://nymag.com/intelligencer/2018/04/an-apology-for-the-internet-from-the-people-who-built-it.html

Lanier: The original advertising evolved into a large-scale uninterrupted behavior intervention process, everyone was under the surveillance of the device, and subtly under the elaborate stimulus. This terrible thing has long been foreseen by science fiction writers, and Philip K. Dick or "1984" directly portrayed such a scene. Despite so many warnings, we have stepped into such a world and created a large-scale behavior correction mechanism under the rule of digital networks. We do this because we want to be both great socialists and great liberals.

We need to be aware of everything that can happen in order to try to mitigate the risks we face, even deep moral hazards. We don't want to imagine ourselves, connecting everyone and creating a new decentralized world. In fact, we are creating a super efficient privacy violation system, and everyone in the world can't escape the claws.

All risks

The types of risk are diverse. Some are unique to financial markets, while others are specific to cryptocurrencies and smart contracts.

The most interesting and scary thing about DeFi is that it combines the two kinds of things that are inherently risky. We put them together, shattered them apart, and then out of some luck, we hope everything is OK.

Don't be lazy if you really want something to go wrong.

Whenever these systems are interconnected, dependent on each other, or stacked on top of each other, you are at great risk. We like to think of DeFi as "DeFi Lego", but if its foundation is not solid, it is actually "DeFi Jenga", and we will also fall into blue and swollen.

Whenever someone doesn't comply with the agreement, you are also at risk. DeFi does eliminate some of the risks of counterparties, but you still cannot avoid the risks caused by liquidity, slippage, and old-fashioned rumors. If a DeFi system that handles millions of dollars of user deposits can be upgraded, then you are literally hundreds of thousands of seconds.

If you haven't followed Chris Blec's Twitter, hurry up! He is doing a study to try to confirm how these scalable smart contracts guarantee security. Just rely on a private key? (This is torture bZx, because they have promised to use a multi-signature and governance solution in 2018.) What is protecting the smart contract code from being changed or controlled? What is guarding the money? Most (let's not say all) these DeFi smart contracts are upgradeable. And … Please note! People are also phished-even those who control complex smart contract systems.

The scope of risks is so wide that we can't afford them, let alone manage them. Too many things threaten individuals, systems, and even these intertwined systems.

What do these risks mean for DeFi's ecosystem? How bad can it be?

February 15, 2020: Fulcrum / bZx

Well, at the same time as my speech (February 15, 2020, 9:50 AM U.S.A.) a bad thing happened and people are still trying to confirm if this is an attack on a smart contract or a vulnerability Use. It is estimated that the attacker made about $ 350,000 through some sophisticated means. Then more details surfaced and things got more complicated. Two days later, a similar attack happened again, and this time the attacker made a profit of $ 650,000.

Translator's Note: The author refers here to the lightning loan attack on the bZx protocol that occurred on February 15.

However, in my opinion, it doesn't matter whether the incident originated from hacking, exploitation, vulnerabilities, or market manipulation. In short, something unexpected happened. Whenever something unexpected happens in the financial markets, it is rarely a good thing. If another party makes $ 350,000 when this happens, it usually means that the other party lost $ 350,000.

These attacks occur because some #DeFi systems are interconnected, dependent, and built in various ways. As a villain who consolidated positions on all these different platforms, TA made a lot of money. However, behind some people's money, others are losing money.

Stani from Aave reposted this expert message in Telegram, detailing what the suspicious vulnerability was. Although the analysis sounds right, the ending still bothers me:

"However, if the above analysis is correct, this doesn't sound like an attack at all. It's not a vulnerability in the contract-it's a complex arbitrage / market manipulation plan that spans the four most well-known DeFi sites, Not an attack. "Information shared by Stani, although not by him

Translator's Note: The bZx Lightning Attack event can be viewed from the analysis provided by PeckShield .

Stop, stop, this is ridiculous! "Our smart contracts haven't been hacked! We're not writing bad code in an insecure way, it's just that our code is being used to do insecure things!" Does this sound like human words?

That's why I said we need to be more diligent and paranoid, and not use legal terms as a shield, let alone use fancy words to cover up the reality. Attempts to shirk responsibility, technically or legally, will not change the facts that have occurred, nor will they compensate the victim. Instead, focusing on creating safe and reliable products to prevent accidents and protect users' assets from loss is the focus.

Note: It was later discovered that the attack was assisted by manipulating / utilizing the system, but the real breakthrough point was in the code itself.

one way or another! In the early morning of the attack, Phil Daian published some prescient thoughts as usual. If you don't know Phil yet, let me introduce him. He has done a lot of research on such things. His talk at Devcon 4 was about smart contract security. He pointed out the following:

"Security is not only reflected in whether the code can work as designed, but also what attributes the product design should provide to the user. The Ethereum community has performed well in the former, while the latter has been a mess due to the huge profits of #DeFi . Just because your code is working properly does not mean that your system is safe. "Source: Phil's remarks in a secure Telegram group

This is the first thing we should all consider, and I have nothing else to add.

Although we can learn a lot from this round of attacks, considering that the bZx team was warned in advance of such attacks as early as September 2019, the lesson is too painful:

Too long to look at: DDEX and bZx are easily affected by atomic price manipulation because they rely on a decentralized price oracle on the chain without verifying the rate of return. This will cause DDEX to lose liquid ETH in the ETH / DAI market and bZx to lose all liquid funds. Fortunately, no funds have actually been lost. —- samczsun

Sam Sun-a security researcher, white hat, and a brilliant smart contract hacker-wrote an article about DDEX and bZx (aka Fulcrum) where he studied how to manipulate the feeds they depend on. What are the consequences of the price method. (It should be noted that he disclosed the vulnerabilities to the appropriate team responsibly and assisted them in the repair process, just as he was helping 0x, Curve, ENS, Kyber, Cheeze Wizards, Livepeer, Authenticeum, and other teams The same. 🙇)

In particular, he investigated whether it is possible to manipulate smart price data to cause smart contracts to respond destructively. Because these platforms rely on price data from Uniswap and Kyber, if an attacker can cause a brief spike in prices, they can obtain loans from DDEX / bZx smart contracts that far exceed their due levels. And this unexpected behavior not only caused some people to make a fortune, but also plundered the wealth of others.

Sam goes a step further and offers some great suggestions for all smart contract developers:

"Don't use decentralized oracles on the chain without strict verification." "Be vigilant in using dependencies on third-party projects"-samczsun

We at MyCrypto deal with this type of dependency every day. The JavaScript ecosystem relies heavily on npm, and every new dependency included in npm adds another 50 dependencies. We can't audit everything, so there are endless attacks on crypto products from the source. The absence of a package.json in your product does not mean that you are not dependent on other package.json … These attacks have verified this.

Here is my favorite sentence in this article:

"Similarly, before introducing a dependency on a third-party project, you should not only consider whether the project has been audited, but also whether its specifications and threat models are consistent with your own project. If you have plenty of time, it is best to go deep Study their contracts. "

Just because we think or assume a contract is secure does not mean there is no risk, because the contract may also be manipulated. And if your contract is combined with that contract, it may also be manipulated. Any manipulation may endanger your system and users. The above case looks like someone manipulated four different DeFi platforms combined to complete an epic attack.

"Without considering i == j, as long as one type of asset is exchanged for the same asset, the female cicada in the pool can be dried. Anyone can do it."-Samczsun

Okay, now back to the lecture you originally arranged …

There is now a relatively new DeFi contract called Curve, which was deployed on the mainnet without a full audit. Guess what happened?

That's right. Sam Sun (again!) Has discovered a potential vulnerability. He responsibly told the Curve team that everyone was panicking like a headless fly, trying to withdraw money from the contract before people had lost it. Thankfully, they did. This allowed the creator of the contract and his friends to keep the money.

I know that everyone wants to create amazing products, and I know that the current environment is exciting. But please be realistic. Deploying a smart contract on the mainnet, letting it grow to one million dollars, and expecting it to not be destroyed, is a manifestation of arrogance, naivety, and ignorance. Not cute at all, and it will become more and more dangerous as the market grows.

Although it is easy to blame the project team for making insecure choices, there are also people who blame the community and Curve users, and the atmosphere of the circle: there is no bottom line and the team is forced to be transparent.

Layer upon layer risk

Various risks when changing USD to ETH

Let's see how the risks stack up when you use these products.

Suppose I am just an ordinary person, and I understand that I can earn 5%, maybe 8%, or even as high as 10% on "DeFi"! Then my assets can be leveraged at 2x, 20x, or 100x? !! This is amazing too! So I took out my dollars to buy ETH.

The process of converting USD to ETH is fraught with risks. Holding cryptocurrency is risky. Financial markets are also at risk. You could also be phished or dropped into a coin scam on Twitter.

Various risks when changing ETH to USDC

Since the price of ETH is so volatile and I still want to enter the DeFi market to earn some passive income, I decided to exchange some USDC. The process of exchanging ETH to USDC again brings additional risks.

USDC, as a centralized stablecoin, needs to comply with relevant regulations, so its token contract includes a blacklist, allowing its maintainers to freeze tokens at certain addresses-when they think they should (or be forced ) When doing so.

-Various risks when changing USDC to cUSDC-

Pretend that the picture shows that USDC is replaced by cUSDC through Compound.

Now I want to deposit my USDC into Compound to earn interest. The contract returned me cUSDC tokens.

This process once again introduces a whole new set of risks. You may lose your private key. Smart contracts may be manipulated or hacked directly. Once my USDC is deposited in Compound, I can only believe that I can retrieve my USDC and believe that the token contract and Compound contract are secure.

Various risks when entering cUSDC into ETHRSIAPY TokenSet

Then I learned about TokenSets again! !! !! It's so cool, it will automatically change hands between cToken and ETH. I can get both interest and profit from the ETH price increase!

I took out my cUSDC and typed it into the ETHRSIAPY collection. Wow! #DeFi!

However, this process introduces new risks! Its smart contracts can also be attacked. Some people may front run your rebalance trades, causing you to lose money. Even if you don't consider taxes, you may still not make money because the market is moving differently than you expected.

The biggest problem is that no one clearly informed me of these pits at any time. Unless I read those little prints and keep an eye on Twitter on DeFi circles, if I lose everything, I will still be confused.

A condensed map of the various risks faced by this series of operations from USD to TokenSets

If we look away and re-examine the whole process, we can see that all of them are risks. At present, everyone is building the DeFi business, which is such a risky business model.

A series of operations in which users convert US dollars into positions in the TokenSets application, virtually integrating multiple risks. That's why DeFi scares me. The risks of smart contracts, technology, cryptography, markets, finance, etc. overlap each other.

We should be afraid.

Obviously I just gave an example of USDC because their centralized "I can blacklist you!" Approach is very funny. But the elephants in the other room are Maker and Dai. I don't comment on this anymore, because everyone knows what's going on.

If someone tells you that Ethereum is completely fine or that the risk of DeFi is low, you better turn around and run. This level of complacency and arrogance did not end well.

Whether they ignore or deny the potential risks indicates that they lack awareness of the consequences of their own operations. If someone builds a DeFi system and inculcates the theory to you, please call for help before (or after) turning around and escaping. Be sure to tell everyone and stand on the roof and yell. In this fast iterating ecosystem, it is very necessary for people to know the latest developments, and this blind attitude is exactly what any smart contract developer should not have.

This mentality is the most serious early warning signal, and it is even more vigilant than the contract has not been audited. Because the contract can be audited, the team's blind and confident attitude is difficult to change. It is dangerous to give money to a group of people who are arrogant enough to think they have built a perfect system, because they are likely to seriously ignore the safety of user funds.

Run away, don't look back.

"I'm sure Tay hates #DeFi"

I heard rumors that I hate DeFi. Let me clarify: I don't hate DeFi. In fact, DeFi excites me, not disgusts me. But at the same time it scared me.

I think what we are doing has unlimited potential. A big vision of cryptocurrency is to allow people to use currency that is not controlled by a centralized entity, and another vision is to "bank people without bank accounts." This means not only the protection of private property from infringement, but also the effectiveness of personal assets. When funds can flow efficiently, human society and the entire world will become better as a result.

Although I tirelessly talked about the risks and the current ridiculous status quo, I still hope that DeFi can succeed, and I believe that everyone who is doing it also thinks so. But the prerequisite for success is that we can be vigilant against the risks in order to mitigate them and reduce them. This can also greatly reduce the possibility of our business failure.

If we only pursue idealism and refuse to listen to others' reminders, we will not be able to solve this problem fundamentally. Someone needs to point out the loopholes in our theory and contracts, so as to improve the robustness of the entire ecosystem and the possibility of success.

The reason I focus on this throughout the lecture is because I think it is very valuable to get rid of disorder anyway. I hope we can get on the right path.

So, how do you mess up anyway? 👯‍♂️

1. Be aware of risks 2. Reduce risks 3. Mitigate risks

We first need to be aware of the risks.

Next, we should reduce risk. The root of risk lies in the attack surface of the system. The simpler the system, the lower the probability of errors, and you should not rely on the external environment or the system.

The next step is to mitigate the risks. If there is a problem with the system (which is unavoidable), how can we respond to mitigate the severity of the problem? Is there a way to reduce the loss to 100,000 instead of 100 million?

I've seen too many bad things to do in the event of a security incident. People tend to focus on reducing risk, thinking that eliminating risk is the only thing worth doing, but forgetting to prepare for the worst in advance. We often overlook some meticulous work, such as how to monitor system failures? How to determine if an accident has occurred? How to respond quickly? How to minimize losses?

Here I want to mention a very good project-DeFi Score. Jordan Lyall and his team have done a lot of research in this area, discovered the risk loopholes of each DeFi platform, and developed a scoring system to help people understand whether the DeFi platform is safe and how much risk it is.

The key point of this type of tool is to make it as user-friendly as possible. In this area, it is difficult to do so. After all, knowledge and concepts are constantly changing, and too little attention is paid to this issue. We should read more, share more, discuss more of these scores, ensure their accuracy, and provide valuable information to people in need.

These scores should help people better understand the DeFi platform. If we can't clearly point out the risks and discuss them thoroughly, users won't know the risks and make prudent decisions. Before people throw all their money into DeFi, they need to understand the risks of the platform, instead of letting these risks lurk under the bright appearance.

When I think about connecting DeFi products directly to MyCrypto, I can't help but remember the promises I made to users. Users trust us, should we hint at how high these DeFi products are? If our goal is simply to attract more users, the answer is undoubtedly yes. But if we really think about users, then it is a real fool to compare these smart contract products that have been online for only a few months with banks.

We need to have a clear understanding of what to say and not to say, because the market will one day pick up, and wait for you to come back and find out that your audience is not only old leeks that have been cut in a bear market, but also When Xiaobai, who was holding a lot of money to enter the market, warned them that the risk was too late.

Ethereum deposited with The DAO

I don't think you are aware of our historical position. The figure above shows the amount of Ether sent to The DAO contract over a month. This is a very typical exponential curve.

2017 ICO funds raised (USD)

This chart is the data of the 2017 ICO, and it is crazy exponential growth, people are completely crazy. The amount of funds invested in The DAO has actually alerted to rollovers, but as the market shifts from bears to bulls, people simply do not realize that this is a problem. Like today's DeFi, The DAO is built by a group of veteran players with cryptocurrency experience, but with the coming of the bull market next year, the industry has jumped from a total of 3 ICOs to 3 ICOs a day, and new leeks are constantly entering the market.

Total assets locked in DeFi (USD)

This picture is the current situation of DeFi, exactly the same hockey line.

About 6 months ago, I said that the lending market would never become crazy. Today, I can be 100% sure I was wrong. The DeFi platform in the market has become fanatical and will become even more crazy in the future. We will see newcomers enter the scene and charge a lot of money for DeFi.

But even if there were any hacks, this curve would not turn into free fall. There may be some retracements or bumps, but in the long run, it will always follow the trend of the exponential curve.

Whether you are speaking on Twitter, writing a promotion for your product, or hesitating to put an unaudited smart contract directly on the main net, I hope you think about the blind attitude of people during The DAO and ICO frenzy . We should help new DeFi players who run into the field as much as possible, rather than counting how much money they can lose. Not only users need to be educated, developers are also, our ecosystem needs higher levels of services and security. Think carefully about the accidents that have happened in the ecology, don't repeat the mistakes.

In the end, you need to take responsibility for yourself, your team, your employees, your peers, your community, and the entire ecosystem. If you mess up irresponsibly, the consequences are shared by everyone.

At this point, everyone should remain highly nervous, which should be something that scares you. Fear motivates everyone to make responsible decisions.

But honestly, what can we do?

The first thing we need to do is openly discuss.

1. We have to ask sharp questions.
2. We need to engage in sincere discourse.
3. We need to give positive feedback to a cause that sticks to our beliefs.
4. We need to open the question, not in the Telegram group or private message.
5. We need to remain skeptical.
6. We need to encourage skepticism in the industry. When I first came into contact with Bitcoin, our belief was that no one can be trusted. Human nature is evil, so we must remain skeptical and vigilant. Trust, but verify. Valuable treasures like responsibility and transparency have been quietly lost.
7. Finally, I very much hope to have more open forums. Pushing things into the Telegram group was awful. You can't use Google to find relevant discussions, and people can't find valuable insights from Telegram. Even if you participate in a conversation, you cannot continue to follow the discussion. At the same time, the news cannot be a worthwhile historical experience to follow. One of the biggest benefits of The DAO incident is that we can go back and see how we thought back then. We can learn a lot from people's attitudes before, during, and after The DAO. This is valuable. (Translator's Note: Is it a bit like we are always discussing in the WeChat group?)

Secondly, we need to ensure safety and education while encouraging sharing. When I say security, I mean everything:

• More secure smart contracts.
• Better research and tools.
• Comprehensive audit and formal verification.
• Scalability and key management. (Not only the user's key management, but also the administrator module in the smart contract)

But in case it gets messed up, be transparent and open to the community. Tell everyone what happened, how did you realize that something bad happened, how you messed up, what assumptions you made, etc. Let others learn from your failures. Now that you have failed, the only remedy at this time is to share experiences and help others not to repeat the same mistakes.

Finally, we need more care and understanding. In the cryptocurrency world, people can easily become aggressive and aggressive, but righteousness and aggressiveness are two different things.

You should never reply to others with "OK, stubborn", especially when they have just lost money. This is provocation and slander, making us all look like bastards.

Similarly, "If they can't write 12 words, then they should not play cryptocurrency!" And, "If they don't understand the risks, then You shouldn't use sarcasm like DeFi at all.

It should never be continued.

It's because you didn't tell them the risks. It's because you've been boasting about your product on Twitter. You've been telling everyone that the product has no loopholes. How could you dare to slap your face at them when they had an accident when they did what you said. This behavior is simply outrageous.

We should be sympathetic and sympathetic to others, to those who have lost their money. Even if they did make a mistake, they shouldn't go down. Because they lose money, it is bad for the entire system. These sad users will never return. No one will lose money and yell excitedly, "Cryptocurrency is great! Shuttle again! I love cryptocurrency!"

"#FOMO> everything"

I'm serious here. Don't underestimate the power of #FOMO. Don't underestimate the power of greed. It will drive sane people to do irrational things and hurt everyone's cause. So stay alert.

Source link: medium.com

We will continue to update Blocking; if you have any questions or suggestions, please contact us!