13 ms·
Attacking the DeFi ecosystem with flash loans for fun and profit (2020)
- paulpauper 6y agothe problem with defi hacks, from the perspective of the hacker, is you get a bunch of eth, which is a lot harder to hide and launder than BTC. As the saying goes, in crypto, your wallet is the bug bounty.
- code-is-code 6y agoDo you really have to launder them? I mean, you do as the smart contract says, it might not even be illegal.
- VectorLock 6y agoEverybody thinks "we don't need laws, we let the smart contracts handle it" until their smart contract is exploited and their funds "robbed."
- Nextgrid 6y agoHave any of the smart contract exploits actually been litigated in court, even if unsuccessfully?
- shawnz 6y agoI don't think "everybody thinks" that. Smart contracts just give you an alternative set of risks which might be more useful in certain circumstances. They are also not immune to having legal consequences either.
- qqii 6y agoIn most cases yes, at some point the attacker will want to turn his tokens into cash and at that point he is at the mercy of centralised services who gets to decide. Here's an old computerphile video: https://youtu.be/UlLN0QERWBs https://youtu.be/UlLN0QERWBs Etherscan provides such a service for ethereum: https://info.etherscan.com/ethprotect/ https://info.etherscan.com/ethprotect/ As long as there are enough centralised services with enough volume that agree such tokens are tainted the decision is effectively made for the entire ecosystem.
- literallycancer 6y agoJust turn it into Monero or Zcash and take out via crypto ATM.
- PeterisP 6y agoLegally, intent matters, a contract is above all "a meeting of minds", and the technical nuances of what exactly the smart contract says only matter if it helps to establish what exactly that intent was - if the contract result clearly does not match the intent (or if the intent is invalid e.g. the contract was written with an intent to deceive) then what the contract says can/should be overridden. Just as in real life getting someone to sign on the dotted line with the intent to cheat them is fraud that can invalidate the contractual obligation, technical exploitation of a smart contract is the same. As you say, it might not even be illegal, details matter, but it might also well be a felony.
- Vinceo 6y agoWhy is it harder to launder eth? You can just exchange them to monero on a non KYC exchange.
- paulpauper 6y agoKYC exchanges don't really exist anymore because they were abused in 2017 and thus either forced to close or comply with regulation (such as the wannacry ransomware virus, in which the criminals laundered their BTC into monero on shapeshift, which at the time had no KYC). Second, cross-chain exchanges may not be possible in a fully trustless manner.
- Acrobatic_Road 6y agowrong and wrong of course. Shapeshift just DROPPED its KYC. https://erikvoorhees.medium.com/no-more-kyc-with-shapeshift-6d95a3e63ddf https://erikvoorhees.medium.com/no-more-kyc-with-shapeshift-... >Second, cross-chain exchanges may not be possible in a fully trustless manner. Monero <-> Bitcoin atomic swaps (codename: farcaster) are coming later this year. In the mean time, you can use Bisq.
- paulpauper 6y agoread the whole thing. KYC only dropped for ERC 20 transactions , which uniswap already does and is not the same as a cross-chain transaction. The abiltiy to exchange erc 20 tokens is native to Ethereum.
- Acrobatic_Road 6y agoexpect them to drop KYC for other transactions as soon as the technology becomes available to do so
- hanniabu 6y agoIt's not harder. This person doesn't really know what they're talking about.
- 6y ago
- CyberDildonics 6y agoWhy would it be harder to launder? The average bitcoin transaction is up to 17 USD, even combining addresses or tumbling is going to eat into your balance.
- paulpauper 6y agoeth uses an accounts model instead of the UTX model for transactions. Tis makes it much, much easier to trace payment flows.
- dboreham 6y agoFairly sure that's not true. The two are equivalent, one is easier for humans to reason about but for a computer they're isomorphic (I assert).
- phyalow 6y agoFairly straightforward in Ethereum to break a audit trail via services like tornado.cash etc.
- qqii 6y agoThe biggest problem wouldn't be breaking the chain but the final step of cashing out. A regular exchange requires KYC for large amounts. Although P2P Crypto/Cash exchanges exist (local{bitcoins, monero}) most simply don't have the volume and still leaves the question of where the money came from.
- qqii 6y agoIt's more of an exploit than a hack, each smart contract by themselves worked as intended but the system as a whole could be exploited.
- tzone 6y agoI think you are few years behind from current state of the ecosystem. You can easily go from Eth -> renBTC (on Ethereum) -> BTC (on Bitcoin chain). None of those steps require KYC/AML or any kind of registration. You can move 100s of millions of dollars that way with very minimal slippage or fees. It is very easy these days to go between Eth <-> BTC without any KYC/AML.
- mbdesign 6y ago> the problem with defi hacks, from the perspective of the hacker, is you get a bunch of eth, which is a lot harder to hide and launder than BTC. Actually it's quite easy with something like tornado.cash.
- etherpaul 6y agoBitcoin does not have tornado.cash
- Acrobatic_Road 6y agoEthereum is like a real world PVP system fought with real money. And I wouldn't have it any other way.
- dylkil 6y agoIts more like PvE system
- plankers 6y agoEthereum is an astoundingly interesting sandbox for blockchain projects and smart contract experimentation. How it ever got moved to prod is beyond me.
- qqii 6y agoThe incentives are much greater to both create useful smart contracts and exploit them when there is real money on the line.
- plankers 6y agoAnd the incentives to let lay-people in on how the game works are much less!
- mandelbrotwurst 6y agoWhat would a “production ready” system for blockchain projects and smart contracts look like to you?
- Jhsto 6y agoNot the parent poster, but as a programmer I think it was an oversight to not formally define the VM. To me, this seems like a poor foundation to build resilient applications atop of. EDIT: And when I mean formally define, I mean something that is machine-checkable so implementations would have a conformance suite.
- 6y ago
- v64 6y agoFlash loans are a great example of how blockchains enable new types of financial transactions that either aren't possible or are very difficult to do in a traditional financial setting. If you identify an arbitrage opportunity in the market, you can atomically borrow a large sum of money to take advantage of the price difference. You also have the added assurance that if the arbitrage opportunity goes away before you can take advantage of it, the entire transaction fails and you only lose the Ethereum transaction fee. It's essentially risk-free arbitrage. This paper [1] dives into detail about how these arbitrage mechanics play out on the blockchain, and how both arbitrageurs and miners manipulate transactions in order to make a profit. [1] https://arxiv.org/abs/1904.05234 https://arxiv.org/abs/1904.05234
- the_local_host 6y agoWouldn't a lender charge money for what is essentially an option to borrow contingent on the arbitrage transaction going through?
- ryebit 6y agoPer other responses, they frequently do charge a special fee (I think Aave charged around 0.09% at one point but can't find good ref right now). One interesting thing I think is still under dev/consideration is adding the ability for MakerDAO to make "flash mint loans"(https://forum.makerdao.com/t/mip25-flash-mint-module/4400/9 https://forum.makerdao.com/t/mip25-flash-mint-module/4400/9) -- essentially a flash loan where the caller can mint an arbitrary amount of DAI without having to back it with anything, so long as they pay it back + fee at the end. There's a similiar idea being worked out for WETH10 (https://github.com/WETH10/WETH10#flash-loans https://github.com/WETH10/WETH10#flash-loans), a project trying to make a feature update of the WETH (wrapped ether) token. I'm honestly unsure WTH the impact of something like these would be, but would definitely prevent arbitrage from going too far out of bounds, since there would always be unlimited liquidity. Multi-party atomic financial transactions are kinda insane.
- AaronFriel 6y agoSo someone else starts a lender to charge slightly less. The race to the bottom happens very quickly.
- qqii 6y agoPersonally I found this article much clearer than the paper: https://www.palkeo.com/en/projets/ethereum/bzx.html https://www.palkeo.com/en/projets/ethereum/bzx.html You can actually follow the money yourself: https://etherscan.io/address/0x148426fdc4c8a51b96b4bed827907b5fa6491ad0 https://etherscan.io/address/0x148426fdc4c8a51b96b4bed827907... https://etherscan.io/address/0xb8C6Ad5fE7CB6cC72F2C4196dca11FbB272A8cbF https://etherscan.io/address/0xb8C6Ad5fE7CB6cC72F2C4196dca11... It looks like neither attacker was able to cash out, but the seccond attacker is moving his funds around even to this day.
- zaroth 6y agoThank you this is a much better place to read about the attack and the bugs in the contracts which allowed it to be pulled off.
- andybak 6y agoThat reads like an analysis of some big event in Eve Online. Fascinating but I obviously have no understanding of either.
- dannyw 6y agoSmart contracts are basically code that can execute and directly interact with cryptocurrency and crypto-tokens. This code is executed atomically; every block; and the entire namespace of Ethereum is callable allowing you to pull together any other contracts or platforms.
- KirillPanov 6y ago> It looks like neither attacker was able to cash out, What makes you say that? If they wanted to, they could simply send the funds back to Tornado Cash, which is basically Zcash-running-on-Ethereum-EVM. The seed funds to run the attack came out of Tornado Cash. It's liquid enough to handle a deposit this size, although it probably wasn't liquid enough back in May.
- dang 6y agoOk, we've changed the URL to that from https://arxiv.org/abs/2003.03810 https://arxiv.org/abs/2003.03810. Thanks!
- zaroth 6y agoEDIT: The article linked by qqii [1] is much better and actually answers all these questions. In short, the smart contracts to allow the loan and to allow the 5x leverage position were totally buggy. [1] - https://news.ycombinator.com/item?id=25806183 https://news.ycombinator.com/item?id=25806183 I used to do some work on Bitcoin, but this all reads like some Cirque du Soleil fever dream. These market making smart contracts will trade at 50% swings within a single block? > The core of this trade utilises a margin trade on a DEX (bZx) to increase the price of WBTC/ETH on another DEX (Uniswap) and thus creates an arbitrage opportunity. The trader then borrows WBTC using ETH as collateral (on Compound), and then purchases ETH at a “cheaper” price on the distorted (Uniswap) DEX market. To maximise the profit, the adversary then converts the “cheap” ETH to purchase WBTC at a non-manipulated market price over a period of two days after the flash loan. So we start with a flash loan of ETH, go through two smart contracts to end up holding 112 “WBTC” against their borrowed 5,500 ETH. > In steps 4 , the trader opens a short position for ETH against WBTC (on bZx), with a 5× leverage. I’m having trouble parsing this sentence. What exactly does this mean? > Upon receiving this request, bZx transacts 5,637.62 ETH on an exchange (Uniswap) for only 51.35 WBTC (at 109.79 ETH/WBTC). What does ‘transacts’ mean in this sentence? And bZx is offering an anonymous trader 5x leverage... based on what? I think they are selling ETH to buy WBTC which blows out the order book and ends up crashing the price of ETH from 30ETH/WBTC to 100ETH/WBTC? > Note that at the start of block 9484688, Uniswap has a total supply of 2,817.77 ETH and 77.09 WBTC (at 36.55 ETH/WBTC). I’m not sure why the total supply on Uniswap of each token is expressed as a price? The trader then converts 112.00 WBTC to 6,871.41 ETH at 61.35 ETH/WBTC on Uniswap. Recall they started off by getting 112 WBTC for 5,500 ETH. > In step 6 the trader pays back the loan, paying a 1×10^11 Wei fee. Note that dYdX only requires a fee of 1 Wei. No idea what Wei are or what the significance is of why they would pay 100 billion of them instead of 1, where they come from or how they are accounted for in the profitability. > After the flash loan transaction (i.e. the first part of this pump and arbitrage trade), the trader gained 71.41 ETH... Wait, I thought they had netted ~1,209 ETH, where does this 71.41 come from? > ...and has an over-collateralized loan of 5,500 ETH for 112 WBTC (49.10 ETH/WBTC). What happened to the 5x leveraged short position? And how in the world did they coordinate all of these separate and interlinked orders to execute in multiple transactions all in the same block in an atomic fashion? Anyway, in the end they need to give back the WBTC by buying WBTC with the ETH they netted; > In total, the adversarial trader exchanged 4, 377.72 ETH for 112 WBTC (at 39.08 ETH/WBTC) to redeem 5, 500.00 ETH. (over the following two days) Look... whatever people are out there building on these networks, this is just bizarre.
- latchkey 6y agoThe other "fun" thing that people are getting into now is front running transactions in the mempool. This is giving rise to a poorly named term, MEV (miner extractable value). The concept of doing arb on that is fascinating and we will start to see projects offering private mempools to prevent this, more and more in 2021.
- hanniabu 6y agoThat won't really be necessary once EIP-1559 is released which is expected in Q2/Q3 of this year.
- latchkey 6y agoSorry, 1559 won't solve this problem.
- hanniabu 6y agoDoesn't it set the network fee?
- dannyw 6y agoNo: MEV is often far greater than the network fee. A miner now having to pay $13 to make $2000 isn’t going to be deterred by having to pay $13.
- imtringued 6y agoAssuming we have a miner intelligent enough to detect all arbitrage transactions. What prevents the miner from paying $2000 for the transaction? I'm asking because that would mean "MEV" would always be 100% of the arbitrage opportunity.
- latchkey 6y agoMiners don't have to pay anything other than capex/opex for transactions. If they can mine their own transactions. Most cannot. Also remember, the cost of ETH to a large miner is significantly lower than market price (hence mining instead of buying).
- alisausa 6y agoTop burny busty chicks only on this site! Follow the link, and you won’t be sorry! - https://adultlove.life https://adultlove.life
- dcolkitt 6y agoThe easiest way to mitigate this is to require two-phase commits on any transaction above X% of the pool. A flash loan requires that the funds be returned before the end of a transaction. If removing funds is a two-step process, then by definition you can’t use attack it with a flash loan. Of course there’s always the possibility of someone with that much capital to stake attacking. But the number of participants with $50 million in funds lying around is a lot less than the number with $0. It drastically shrinks the attack surface.
- v64 6y agoMaker had to do a similar two-phase mitigation after a flash loan was used to borrow enough MKR token to change the result of a governance vote. [1] [1] https://forum.makerdao.com/t/urgent-flash-loans-and-securing-the-maker-protocol/4901 https://forum.makerdao.com/t/urgent-flash-loans-and-securing...
- larrydag 6y agoDefi is an unfortunate name. I thought this article was referring to the Defi Solutions loan software. https://defisolutions.com/ https://defisolutions.com/
- deleted 6y ago[deleted]
- dang 6y agoThe originally submitted paper is here: https://arxiv.org/abs/2003.03810 https://arxiv.org/abs/2003.03810.
- alisause 6y agoI was a really bad girl. Punish me with your dick in my mouth. - https://adultlove.life https://adultlove.life
- cryptica 6y agoI don't understand why only scam projects succeed in the crypto space. It's seems like investors are intentionally choosing projects that are scams, which are inefficient, which are lying about their features... Honest projects which actually deliver are ignored completely.
- moonbug 6y agothis stuff is all stupid.
- ncmncm 6y agoJust what we need: even more financial instability.
- jklepatch 6y agoIf you guys are interested in Flashloans, I have many videos about them on my youtube channel EatTheBlocks: https://youtu.be/03jO9vbrXvY https://youtu.be/03jO9vbrXvY As well as a course to teach how to build an arbitrage bot using flashloans: https://eattheblocks-pro.teachable.com/p/profitable-flashloans https://eattheblocks-pro.teachable.com/p/profitable-flashloa... (just to be clear I am not selling a magical money making machine, what you will learn is the process of building an arbitrage bot, and you will still need to do some work to make some profits)