Chengdu Lian'an: Considering DeFi from the balancer event

Since 2019, DeFi has gradually turn into a hot spot for blockchain, and a lot of funds have begun to flood into various DeFi projects. Since the Synthetix project emerged, DeFi projects have sprung up in people's sights. Nevertheless , with the continuous development of DeFi, the security dilemmas of DeFi projects have grown to be increasingly more urgent.

In the recent event that Balancer was attacked, the attacker used the loophole developed by the combination of Balancer's fund pool and deflationary currency to steal $500, 000 in the fund pool. Less than twenty four hours later, the balancer was attacked again. The attacker used Compound's "borrowing is mining" feature to steal unclaimed Comp coins from the fund pool.

For the initial attack, we have already analyzed it before, and interested friends can move ().

About the 2nd attack, mcdougal thinks that the attacker's behavior is somewhere between squeezing wool and an illegal attack, and can not say that it's an illegal attack.

On usually the one hand, the attacker has indeed violated the concept of Balancer's contract design and used Balancer's code vulnerabilities to steal benefits that did not fit in with them.

But alternatively, the funds stolen by the attacker are not the main in the capital pool, however the profit generated by Compound's "borrowing is mining" feature, and even if the attacker will not attack, the Balancer contract it self isn't reasonable. Allocate this money to users.

This is just like the empty cartons produced every day in a supermarket. The business will not plainly stipulate dealing with it. Generally speaking, when it accumulates to a certain degree, a specific employee finds it and sells it, which employee benefits. At the moment, an outsider came. That he unearthed that these paper boxes could generate benefits, so that he applied for employees, and left the work immediately after trying to sell the paper boxes and went to another shop. Following the 2nd incident, the Balancer official did not make any relative repair measures, which indirectly shows the official attitude, the official may be more inclined for this is a kind of "sweeping wool" behavior.

And also this incident involved an overall total of three DeFi projects. Balancer, dydx and Compound.

What exactly is DeFi?

DeFi means "decentralized finance" in Chinese, and aims to make use of blockchain technology to perform the functions of lending, storage, and payment in old-fashioned finance, shorten the transaction time in financial transactions, reduce transaction fees, and solve problems such as for example transnational difficulties.

Currently the hot projects on DeFi include Compound, Maker, dydx, and so on, as shown in the next figure:

In DiFi projects, many of the tools of the traditional financial industry are directly moved to the blockchain, such as for example lending and storage. However the blockchain and the real world have become different, and their underlying logic is significantly diffent.

Like in neuro-scientific old-fashioned finance, "credit" is the fundamental condition of credit. Banks will rate someone's credit to determine whether or not they can lend to him. In the closed world of blockchain, due to the privacy of blockchain, addresses can not be associated with people, so there is no "credit" attribute. If you wish to achieve "credit", you'll want an oracle to acquire real-world information.

Nonetheless it is precisely due to the big difference between the blockchain and the real world that DeFi can realize some functions that can not be realized in the real world.

dydx lightning loan:

0 Mortgage loaned 30 million US dollars

In the initial incident of the balancer, the attacker used dydx to borrow $30 million, but without the collateral. This isn't possible in the traditional financial field. The borrowing methods in the traditional financial field use "asset mortgage" or "credit mortgage" as a means in order to avoid borrowing risks. Nevertheless , due to the characteristics of the blockchain, it could be achieved. The transaction is rolled back, so it's possible to reach 0 mortgage for large loans.

dydx allows users to produce a massive amount loans with 0 mortgage, and users only have to return the loan in a transaction. If the consumer will not return the loan following a transaction, the transaction will undoubtedly be rolled back and the money spent can be recovered, thereby steering clear of the principal risk. Although the loan must be came back in a transaction, the smart contract allows the consumer to execute multiple operations in a transaction. In this transaction, the consumer can buy a lot of a specific token at the lowest price, and then sell it at a high price. Even if the cost big difference is extremely small, considerable gains may be accomplished on the basis of a lot of principal. If it's placed in the traditional financial field, it really is broadly speaking difficult to make this happen kind of operation. But with dydx, anybody can get this "huge quantity of money".

You will find always two sides to the emergence of new things. While dydx flash loans provide ordinary people who have the possibility of using huge sums of money, it also provides help for hackers hiding in the dark. Just as Balancer was attacked for initially, when there is no dydx, hackers must raise a lot of principal in order to achieve the deflationary tokens in the fund pool, otherwise the attack will not be possible.

Balancer:

By charging

To control your own personal assets

In old-fashioned finance, users need certainly to pay management fees to a third-party management agency to balance their assets and protect their value. However the emergence of Balancer broke this example, asset owners can protect their asset value by charging fees.

Balancer allows users to determine their very own fund pool and put their different assets into the pool. If the selling price of different assets changes, the resulting price big difference will induce arbitrageurs to change in the fund pool, thereby making the funds in the pool This content of varied tokens reaches a balance. Arbitrageurs obtain benefits through arbitrage, and fund owners therefore balance the worth of these assets.

Assuming that you can find two tokens, DAI and WBTC in a fund pool, when DAI appreciates externally, the ratio of DAI to WBTC will undoubtedly be paid off, that'll induce arbitrageurs to convert their WBTC into DAI in this pool before funds The pool exchange ratio is equivalent to that of the external pool, making the DAI holdings in the fund pool increase and the general value decreases. When DAI depreciates externally, it'll induce arbitrageurs to convert the DAI in their hands into WBTC, simply because they held a lot of DAI earlier in the day, and when combined, the general value rebounded again. After continuous operations by arbitrageurs, a balance is definitely maintained in the fund pool.

Balancer's fund pool model isn't too problematic, but when encountering special tokens such as for example deflationary currencies or Compound, problems will arise. The core of the Balancer fund pool is the variable exchange ratio. Under normal circumstances, this ratio can change with the inflow and outflow of different tokens, so that the amount in the pool reaches a balance. Nevertheless , when encountering deflationary currencies or special currencies such as for example Compound, The incoming and outgoing data has errors with the data used to calculate the ratio. This error allows the attacker to attack and profit.

How exactly to view DeFi

It isn't difficult to see from the above two projects that DeFi isn't just a matter of moving the real-world financial system to the chain. Due to the big difference in underneath layer, DeFi may do many things that the true financial system can not do, such as for example zero mortgage lending, cross-border remittance and other very promising functions. But there's also great risks and problems that follow, such as for example how exactly to talk to the real world, ways to get government approval, and how exactly to solve security problems.

"Give me a fulcrum, I can move our planet. " In contrast to old-fashioned finance, underneath layer of DeFi relies on smart contracts, which are essentially programs. Programs have incomparable efficiency and convenience in old-fashioned finance, but there's also code vulnerabilities that old-fashioned finance does not need to take into account. If hackers find this type of "fulcrum" in the smart contract, they are able to easily leverage tens of millions of assets.

Therefore , Chengdu Lianan recommends that readers treat DeFi rationally, choose safe and promising projects for rational investment, execute a good job of research before investing, and become vigilant about undisclosed smart contracts and audit reports.