A Brief History of DeFi Hackers: There Are Risks Everywhere, But There Are No Lack of Opportunities for Wealth
Original title: "A Brief History of DeFi Hackers: There Are Risks Everywhere, But There Are No Lack of Opportunities for Wealth"
Original source: Babbitt
This is the era of the Wild West - hackers and bugs are everywhere.
It is important for participants to understand the history of Ethereum's vulnerability attacks. From The DAO to the Parity hack, these protocol-level incidents impacted the security of Ethereum contracts. As more applications are built, the number of attack incidents also increases.
This is especially true in DeFi.
In DeFi, we don't have to trust money to others, but we have to trust code.
We must trust that the design of the code has no flaws - including bugs, economic risks, oracle manipulation, and even centralization risks. But it's hard. We are all human and we make mistakes.
This is our saving grace: the longer the code is exposed, the more value is locked, the stronger the code. We call it the Lindy Effect. One more day without incidents, and we are one step closer to the vision of trustless finance.
Hugh Karp is a deep dive into hacks and vulnerabilities. (But he himself was hacked!)
Ethereum's early development experience inspired Karp to build Nexus Mutual, a decentralized Insurance Alternatives.
The author of this article is Hugh Karp.
A Brief History of DeFi Hacking
DeFi offers a land of opportunity. Despite all the traditional finance folks calling it a "scam" for its double-digit yields, you can find and create wealth. Meanwhile, those on the cutting edge have been making money.
While there are risks to be sure, markets are still very inefficient and in an age where banks are offering 0% interest rates, it is worth putting old prejudices aside and Stay with it for a while, at least, before digging deeper.
In traditional finance, most of the risk comes from having to trust people with your money.
While many say DeFi removes trust, it actually transfers trust from individuals, institutions, and the surrounding legal system to code. In theory, this means that if we can trust code to behave as expected, then we can "remove" trust. Unfortunately, it's hard to code with 100% accuracy (even after auditing). Most long-time Ethereum users have experienced at least one pain point during this journey.
To give you an idea of coding accuracy, here are the number of errors per line of code:
- Industry average of 15-50 per thousand
- 1-25 per 1000 delivered software
- NASA 0.1 / 1000
Coding is not easy. Humans make mistakes all the time. The problem is that there are tons of risks with Ethereum and decentralized finance.
Is this risk better than trusting others? Sure, but it's still too early.
Here are some historical breaches to give you context...
Early Times
One of the first significant cases of coding errors on Ethereum was The DAO. The attack on The DAO project, followed by a disagreement in the community over how to "fix" the problem, led to a fork of Ethereum and the creation of Ethereum Classic (ETC).
The next major vulnerability event is the Ethereum Parity client bug. In that bug, the widely used multisig suffered from two separate incidents of vulnerability that resulted in the loss of ETH worth millions of dollars at the time, as well as further fallout from a philosophical standpoint.
Together, these bugs are the first major security incidents in the history of Ethereum. We now see them as code with logic errors that simply don't work as expected.
These two events were also the main sources of inspiration for Nexus Mutual's first product, the Smart Contract Cover.
Age of oracles
The second major wave of DeFi hacking is driven by on-chain Caused by oracle manipulation, usually by flash loans.
This type of attack is very complex to execute, but follows a similar pattern where a system that relies on a price feed temporarily manipulates the price feed to distort the protocol's internal accounting. Funds are then deposited at a favorable rate and withdrawn in another currency or the same currency immediately after resetting the oracle to normal values.
While in most cases an underlying logical error may also be triggered, this is not always the case. A community discussion ensued: Are these incidents hacking attacks, or are the economic logic of the protocol exploited?
But, in general, these types of problems need to be avoided if DeFi is to be more successful.
Harvest Finance: A Skilled Farmer Raised $33.8M From FARM_USDT and FARM_USDC Pools Using Flash Loans
< /p>
Value DeFi: 7,000,000 loss. Here's another harsh lesson sparked by flash loans.
Cheese Bank: Hackers took away $3.3 million through flash loan AMM oracle attack
Currency Lego Era
In the past few years, more and more DeFi Protocols have been released and continue to depend on each other. This is the beauty of open finance and composability - we can use existing protocols to build new applications. The downside is that this naturally starts to expand the attack surface.
With one of DeFi’s great strengths, protocols are increasingly building on each other, but this also multiplies risk.
The third wave of attacks tends to focus on yield aggregators, which are often built on top of many other DeFi protocols.
These protocols tend to be more risky than the base protocols simply because they have a larger attack surface. As a developer, it's easy to make assumptions about how another protocol works, but sometimes subtle differences at the edge of integration can cause problems.
Centralization Risk
This short but interesting history focuses on coding risk, Assuming DeFi is fully decentralized, coding risks cover the vast majority of risks. but it is not the truth. Many protocols are still some way away from decentralization, as many of the risks in DeFi come not only from smart contract bugs, but also from centralization.
Probably the broadest risk in all of DeFi relates to stablecoin failures. This could include USDT losing its peg or USDC having funds seized by the government. Failure of MakerDAO's DAI peg could also cause major problems, but is more likely due to failure of economic incentives or risk management oversight.
If you're in DeFi, the general failure of any major stablecoin would be catastrophic. This could be a major risk for the industry as a whole, especially while it is still in its infancy.
Back to DeFi protocols, when interacting with most of the newer protocols, there is often a high risk of centralization, as teams often have the potential to upgrade contracts, or "run away" and steal protocol liquidity in the worst case scenario. So please be aware of this! Before depositing funds, try to find out if there are any built-in time delays or other safeguards.
There is still a lower level of centralization risk in some of the major DeFi protocols. There is always the potential for governance attacks, where malicious parties can make upgrades to the system. We haven't seen many of these cases yet, but it's entirely possible.
The more diverse and broad the token holders are, the better.
Economic Incentive Risk
Another major category to be wary of is the failure of economic incentives. Several DeFi protocols are testing new economic games to achieve certain results, which often require balancing incentives to encourage the right user behavior.
Many of these incentivized games are unproven riskier than others, and I'm looking at algorithmic stablecoins. Users, therefore, be aware of the extent to which the protocol relies on economic incentives to work properly.
DeFi is an opportunity
As scary as this may sound, DeFi is an opportunity for those willing For those who take higher risks, there are huge rewards. The risk-to-reward ratio in DeFi is huge, but the market is still very inefficient.
The upside is that inefficiencies correspond to opportunities for those willing to take further risks.
One of the attractions of DeFi is the ability to earn yield on stablecoins or holders of existing cryptocurrencies such as BTC or ETH.
In this use case, the risk spectrum is lower, what I call the risk comes from the underlying protocol itself: Uniswap, Compound, Aave, MakerDAO and Balancer.
These protocols are much more decentralized than others, so risks tend to be more limited to smart contract risks, failure of economic incentives and potential governance attack. These protocols have been on mainnet for quite some time and have billions of dollars in value, which means that they have been battle-tested to a reasonable extent, showing that they are relatively immune to most of these risks. threats, while potential governance attacks have yet to be fully tested.
This is probably the best option if you want to move from almost 0% yield in your bank account to higher levels such as the 4-10% range good place to start.
If you want to protect your money in DeFi, Nexus Mutual also offers protection against smart contract risks. Even better, starting April 26, Nexus Mutual will expand to a new product called “Protocol Cover,” which covers smart contract risks, oracle manipulation, failure of economic incentives, and governance attacks. This is one of the safest ways to start earning gains in DeFi.
There is so much to learn, you could write a whole book on DeFi risk management.
The key is to start with an amount you can afford to lose and learn over time. Avoid taking too much risk, and make sure you manage when you want to allocate a larger position for any one scenario or risk.
DeFi is a journey requiring full autonomy that is both dangerous and potentially very rewarding. Properly managing your risk will set you up for success.
Original link
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
