Do you really understand flash loans?
Written by: 0x26
Accompanied by Harvest.finance lightning loan attack + arbitrage at the end of October In the last week or two, there have been 4 flash loan attacks, large and small. The most interesting thing is the flash loan attack of Value DeFi Protocol (YFV). It is said that before the attack, the team stated in AMA that it is the safest DeFi protocol and will not be attacked by flash loan. The hacker's "real money" taunt.
Transaction Hash: 0x217298bd38ed12b16e0cd65 ce0b464c3810e0479a99a1464aed5e6768b2a4c50 (UTF-8)
And this triggered a follow-up dialogue that was ridiculous. A nurse who suffered losses in YFV sent a letter on the Ethereum chain to this gentleman who "really understands", saying: "I lost $100,000 in your attack. I am a nurse and these are all It's my savings, hope you give it back to me. Everyone gets sick. Think of the nurse who took care of you when you were sick. May you always be healthy and happy. May God bless you." Then actually received a message from the hacker Transfer of 50,000 DAI.
Transaction Hash: 0xdf10b20e49135306cfe16 fc87da5fc6d859755ecbfd76180b36898052c765fab
The YFV team also sent an on-chain letter to the hacker: Obviously, we don’t know about flash loans as much as we thought. A bounty of 1 million DAI will be given to you, and the remaining DAI will be returned to our affected users. We have a plan to compensate affected users and it would be helpful if you could return some of the funds.
Transaction Hash: 0x8bc8a4f4fa0c54702d018eaf7adee5937be566366ea8d4a3adb191a3dc71b855
so , What exactly is a flash loan?
In a traditional economy, when a lender makes a loan to a borrower, there is always the possibility that the borrower may not be able to repay the debt risks of. This leads to the following question:
Is it possible that there is a situation where money is lent but does not exist possibility of being repaid.
A quick loan from a liquidity pool in one transaction Use and repay
the above things that cannot be done in traditional fields , completed by the blockchain, this is the flash loan. A flash loan is a loan that is only valid in one block transaction. If the borrower does not repay the loan by the end of the transaction, the flash loan is a failure and will not be executed. This is because the blockchain will not execute the transaction if the repayment conditions are not met.
The assets of the flash loan come from a public smart contract fund pool. The more well-known and popular ones are the fund pools provided by Aave and dYdX. Aave’s flash loan interest rate is 0.09%, while dYdX’s smart contract only requires a fee of 1Wei when repaying.
Flash Loan Use Case
But what is the use of flash loans? As of now, the following use cases for flash loans can be identified: arbitrage, providing false trading volumes to trading pairs, voting on flash loans, manipulating price arbitrage.
Arbitrage
;
With flash loans, you can carry out arbitrage on different DEXs without holding a position in the token being arbitraged or facing the risk of price fluctuations. A trader can simply take out a loan, enter into an arbitrage trade, and pay back the loan plus interest. At this time, the only test for arbitrageurs is the information on finding arbitrage opportunities and the ability to design arbitrage logic. With the development of arbitrage trading, simply looking for arbitrage opportunities can no longer meet the needs of hackers/geeks. More often than not, they will use flash loans to artificially create arbitrage opportunities, which we will discuss later.
Add water to the trading volume
< /p>
Another use case is to create fake transactions. The transaction volume of an asset is an important criterion indicating its transaction popularity, especially on decentralized exchanges. The ordering of tokens is Sort by volume. Malicious trading platforms or traders can mislead other traders by artificially inflating the trading volume of an asset to attract interest.
Although it costs little to no cost to conduct water injection transactions on centralized trading platforms, it may not even need to hold There is this part of real assets, but water injection transactions on DEX require traders to hold and use this asset. Lightning models can eliminate this "barrier". Taking March 2020 data as an example, water injection transactions can increase the 24-hour transaction volume of Uniswap’s ETH/DAI market by 50%, while the cost is only $1,298 (flash loan from dYdX).
Flash Loan Voting
In a MakerDAO vote initiated by the development team of the liquidity protocol B Protocol , the B Protocol team borrowed 50,000 WETH ($20 million) from dYdX through a flash loan, and then mortgaged it to AAVE Obtain 13,000 MKR tokens ($7 million), and then use this part of MKR for community voting, and return it after the voting is completed. The topic of this vote is to include B Protocol in the whitelist of the MakerDAO oracle to gain access to the MakerDAO price oracle.
After this behavior was discovered, the Maker team contacted the B Protocol team, and B Protocol stated that it would be responsible for this behavior and will further deal with it later. And this has also aroused discussions in the Ethereum community on the manipulation of community governance by flash loans.
Manipulating price arbitrage
Pull up/smash down—arbitrage
;
With a GAS transaction fee worth 0.5 ETH, a flash loan transaction was executed on February 15, 2020, and the main operation of the flash loan was completed in block 9484688. A total of 74 transactions were manipulated, and a profit of 1193.69 ETH was obtained (note, the unframed ones are the actual data, and the framed ones are the optimal parameters).
The most important part of this transaction is to conduct leveraged transactions on the decentralized trading platform bZx, To increase the price of WBTC / ETH on the decentralized trading platform Uniswap, thereby creating arbitrage opportunities.
First borrow 10,000 ETH from dYdX with a flash loan, part of the ETH is shorted at bZx with 5 times leverage, and the other part is replaced with WBTC at Compound, and when the price of ETH drops, use WBTC to exchange ETH back to complete the use of lightning The price of the loan is pushed up/smashed, and profited from it. After waiting for the price to stabilize, exchange back to WBTC in Kyber and return Compound’s ETH loan.
Oracle Manipulation—Arbitrage
It is by interfering with price feed oracle Opportunities to interfere with the agreement's judgment on token prices, thereby "maliciously" creating arbitrage opportunities.
As previously Attack Methods in the DeFi Era: Price Feed Oracle Manipulation", it is very common to use the data source of the DeFi protocol to conduct price feed oracle attacks. Users trade sUSD on three (Uniswap, Kyber, Synthetix) trading platforms through flash loans, and two of them are price feed oracles of bZx, the flash loan provider platform.
1. The flash loan platform bZx lent 7500 ETH.
2. A total of 4,417 ETHs were exchanged for 943,837 sUSDs at an average price of 213 sUSD (including direct transactions on third-party platforms, and price feed oracles such as Kyber market crash).
3. Continued selling of ETH on Kyber and Uniswap's sUSD markets to drive down prices.
4. Because bZx uses Kyber as a price feed oracle, bZx's ETH price dropped by about 58% at this time. Users can exchange equivalent sUSD for more ETH.
5. Exchange ETH for sUSD on the third-party platform Synthetix.
The hacker exchanged a total of 1099841sUSD for 6799 ETH (average price 162sUSD), and the final income of the hacker was the remaining 3082ETH, and 6799 ETH obtained from oracle machine attack arbitrage. After repaying the 7500 ETH flash loan, the profit was 2381 ETH.
DeFi discussions triggered by flash loans
With the vigorous development of DeFi, more and more protocols are launched. The first thing these projects face is that there is no contract audit. The catastrophic consequences of this situation have already happened in YAM . And even if the contract is audited by multiple parties, it does not mean it is completely safe. The contract audit company will not help the project party to check the economic model. This is the reason why cross-platform price feed oracle manipulation-arbitrage occurs frequently.
Flash loan is just a tool in the DeFi world, allowing users to use a An ingenious way to gain this ability in a short period of time. With the development of the industry, it is inevitable that more similar tools will appear, resulting in more and bigger attacks.
In the face of the DeFi world without unified management, whether the attacked funds can be recovered depends entirely on the mood of the hacker . Both YFV and EMN hackers paid back some of their funds, while more hackers chose to pocket the funds they obtained. This raises another question, Is there crime in the DeFi world?
Facing the endless possibilities of blockchain, Flash loan is just a tool, more importantly, what can you create for yourself with this money in this block?
Reference reading:
Original link, with deletion
《Flash Loans and securing the Maker Protocol》
"Harvest.finance resumes flash loan attack, loss of about 33.8 million US dollars"
"Origin publishes attack information, calls on hackers to return Funding"
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
