Billion-Dollar Crypto Loan Is Easy to Get, but Gone in a Flash
wsj.com
wsj.com
https://twitter.com/bertcmiller/status/1402665992422047747?s...
and here
https://twitter.com/0xmisaka/status/1525964196181057537?s=20...
You can go pretty far down the rabbit hole on crypto twitter.
This was also a cool event, there is 7 hours of video and slides, which have more of the kind of info I think you're looking for...discussions about protocol flaws and design etc.
https://flashbots.notion.site/flashbots/mev-day-836f88806995...
https://www.openzeppelin.com/contracts
That’s the closest thing to a collection of standard contracts for protocol builders to use that I am aware of. I’m more on the MEV side - I try to profit from protocols rather than build them. So it wasn’t my first thought.
I don’t think it counts as one, I was thinking that needs the governance contract to either recursively call itself or call an external unrelated contract
https://twitter.com/BTCTN/status/1520425720631156736?s=20&t=...
It's gotten incredibly competitive, and there has been quite a bit of consolidation. You used to be able to make a bot that could just make a few thousand dollars per day. Now you're either making 6 figures per day as part of a team, or a few hundred dollars per day on your own. One of the reasons you need a team and financing is that much of it is infrastructure based - being right next to miners/validators in the same server rack, etc. It takes significant resources to have nodes exactly where you need to have them, in various parts of the world.
It's also feast or famine. Sometimes, you'll wake up with hundreds of thousands of dollars from thin air. Here [3] is a loan liquidation using a flash loan from last week that netted the person that submitted it $366K (that was the value at the time) - in a few milliseconds. The only money they had to have to do this tx was the $1.50 transaction fee. The ~$8 million necessary for the liquidation was flash borrowed from a Pancakeswap pair.
[1] https://docs.flashbots.net/
[3] https://bscscan.com/tx/0x73d37b728ebd55088d0d7ccd3f82a485ac3...
If so that was a great deal and worked out, but if the deal hadn't worked out for whatever reason, a bug in the code for the bot etc what would the downside be and how would it be enforced?
If the contract loans the tokens and isn’t paid back by the end of the transaction, it reverts as if nothing ever happened. Ethereum transactions are “atomic” - either all parts of the tx succeed, or they all fail. So there is no risk to the lender, they always get paid back.
But yes, once you do all of that...it actually is a money printing machine that will never end as long as markets have volatility. It's a bit like living in the movie Ready Player One...once you are clever enough to run the gauntlet, riches are yours.
If you can show that you have the knowledge to do it, getting the money to do it is absurdly easy these days. Crypto VCs are far different and much more accessible than traditional Silicon Valley VCs that only talk to connected startup bros from Stanford or MIT. They’ll all listen to what you have to say if you know what you’re doing. They also move with lightning speed relative to their SV counterparts, and they seem genuinely interested in helping those they invest in. My experiences with them have been off-the-charts amazing, compared to 100% disappointment I have had with SV VCs/angels.
Yeah this is tough. Even just dealing with CBP (8 decimals) I was losing fractions of cents here and there, not sure how they get it right, sometimes seems like randomly round to come out even (cases like emptying ballance).
And despite this being inherent in the DeFi world, people still believe that such systems are better than fiat money?
That said, there are still challenges. Last week, for 6 hours, there was $1 billion up for grabs [1]. Nobody noticed it except for one person, who only took $13.5 million. But bots are coming that will spot these things instantly....I have one under development that would have caught it.
[1] https://twitter.com/0xngmi/status/1524891992429318144?s=20&t...
Surely the people who came up with this financial innovation had some other use for it in mind, one that would outweigh the inherent externality of this-is-a-perfect-vehicle-for-fraud, right? ... right?
An example in the real world...say you're an employee at a large tech company with a bunch of stock options. You want to exercise those options and sell them. In order to exercise those options, you need money that you do not have. Luckily, your brokerage offers a service where they'll exercise the options for you and sell them. You're essentially borrowing their money very quickly to get out of your position.
In DeFi, you could use a flash loan in order to deleverage in a position. So instead of selling a small increment of your position and paying back your loan multiple times, you can instead take a flash loan and pay everything back at once to deleverage.
> Such flash loans have beneficial uses, including help for traders trying to capitalize on price differences between cryptocurrencies on different exchanges. In that sense, they are much like the financing that an investment bank might provide to an investment fund to make bets on different stocks or currencies.
This is their predominant use as well.
If you bid up the price of something on Sushiswap, that also trades on Uniswap, a flash loan will be deployed pretty much in the same block, pull all available capital necessary, and fix that price imbalance to its maximum potential.
Just a form of arbitrage.
Projects have to do system design that accounts for this. Beanstalk did not seem to account for the idea that the liquidity pool would have more than 50% of the BEAN supply eventually. But aside from that, having proposals passable in one block of deposit is the primary vector. Teams and communities like this model though because it basically comes down to "imagine how rich we would be if an attacker actually tried to buy all the tokens, I hope state actors get involved to really test that theory" because then it wouldn't matter if one block or many blocks was used if an actual organization was determined to pass something, this mentality is just not compatible with flash loans when all the liquidity is purchaseable already.
There are other case-specific uses for them, but loan liquidations and arbs are the big ones.
So if you bring in outside money from a place like AAVE for a DEX arb, then whatever fees you are paying to AAVE are an extra, optional expense, since the swap fees must be paid regardless.
I’m asking if borrowing from the dex pools itself is cheaper than borrowing from AAVE
Fyi, their intended use case is to remove arbitrage opportunities, something that improves the UX for ordinary users because you don't have to worry about buying/selling at a suboptimal price.
[0] Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit. https://arxiv.org/abs/2003.03810
Arbitrage is not unethical. I don’t know why you paint it that way.
Another common use for cryptocurrency loans is speculating on other cryptocurrencies or borrowing a lot for a short-term pump & dump. There's smart contracts that will let you borrow at 20% interest leaving the balances of both known, and they'll margin-call you if the trade goes too far against you.
There's no use for these loans outside of cryptocurrency-land: If you buy e.g. an apartment complex, that asset cannot be used as collateral for a cryptocurrency loan and you can't get millions of dollars for cheap like you can a conventional or government loan.
If, analogously, my bank had a program where people could propose actions to the bank and vote on them by putting dollars in a "yes" or "No" jar - and I started a "give me the bank" proposal, took out a massive loan and won the vote... What have I done wrong?
For another example, let’s say you were an employee of a retailer with the power to set a discount on certain items. You suddenly set a 100% discount on every item in the store and then buy all the inventory for $0. Try explaining to the police that you were actually fully within your legal right to do that.
But if you were the board, or the majority shareholder, it would be fine. Which is what happened here.
They borrowed money, bought a majority of the BEAN, used that BEAN to vote on their proposal to take all the money, and it passed. They kept the money, sold the BEAN, and returned the borrowed money.
I am fairly sure a majority shareholder could not just vote to give themselves all of a companies assets.
But yes there are other deterrents like not optimizing share price or returns for the other shareholders, by laws, state laws, rules from the exchange you trade on and mayyybe a regulator
Just much faster in crypto because they allowed for their governance to be vulnerable to flashloans.
And as much as your example would likely result in some kind of conversation with the police, it also highly depends on whether you discounted items fraudulently or if you did it because you specifically were in the position to do so. Your example describes it as though you had full legitimate power to discount certain items up to 100% off. At that point, at worst you would have violated company policy and not the law. You might get fired for it but when a retailer you work for offers a discount you are eligible to participate in it.
Also I don’t think your retailer comparison works, in this case the power to give the user the rights and ability to create 100% discounts was designed into the system and although the outcome is unintended, it is not a flaw because the system allowed it and everyone using the system was allowed to audit it before putting value in.
"Code is law" is the mantra of people who are either ignorant of how the law works or attempting to run from the law [1]. You don't get to choose whether or not the law applies to you [2].
[1] Or both. These aren't mutually exclusive categories.
[2] Source: see every sovereign citizen case ever. I was originally going to write "ask any sovereign citizen," but then I remembered that the failure of their legal theories to ever find purchase in a courtroom does surprisingly little to make them realize that they are wrong.
Edit: see Tor/I2P vs censorship law, or BitTorrent vs copyright law
I would also counter the idea that we choose whether code applies to us! Loads of daily interactions with different companies or the government go through automated systems that make their own decisions.
We don't have line item vetos on what affects us in life, in a lot of scenarios. There are a whole lot of package deals, and big bureaucracy is a part of that.
If they get caught. If you were opposed to copyright law, why go toe-to-toe against IP lobbyists when you can make a computer program that makes their tyrannical laws irrelevant?
> Censorship laws don't disappear just cuz you have a trick around the implementation of some firewall.
Censorship laws don't need to dissapear so long as they are rendered unenforcable.
> I would also counter the idea that we choose whether code applies to us! Loads of daily interactions with different companies or the government go through automated systems that make their own decisions.
You can make code apply to you, but you cannot make code not apply to you. Once someone starts using a technology, that changes the game in an irreversable way.
> We don't have line item vetos on what affects us in life, in a lot of scenarios. There are a whole lot of package deals, and big bureaucracy is a part of that.
No, you merely accept bureaucracy because you are old and complacent.
In most western societies this happens only if absolutely necessary, after many warnings and the reactions are quite measured (e.g. you won't get shot for a parking ticket). The existence of assholes make people ask for rules to reign them in.
Whoever can send armed people to your door makes the rules. If you are a lucky you have some degree of say who that is (elections) and what that rules might be (e.g. ballot measures, public discussion). If you are unlucky the militia just shows up and takes you to a dark alley.
Crypto (or any other technology for that matter) doesn't change that fundamental fact that your physical body is located somewhere on this world and is accessible to someone. It takes some time for the bureaucracy and the laws to adjust but it always happens. If need be (e.g. you created a smart contract that does something illegal) you can be punished so other people won't do the same.
In conclusion:
> No, you merely accept bureaucracy because you are old and complacent
Is not how these things work at all.
It would be interested to see how different courts would settle the matter. I imagine it will be an interesting legal future for various crypto projects.
The courts have not really tested that, have they? I figure HN would alert me if they had.
A wounded party will claim an exploit. Most bugs / security flaws are, in fact, code that is working perfectly as written, but not as intended.
Dictionaries reflect the public's usage of words, not the other way around.
Similarly, courts are supposed to reflect the values of people, people's values aren't informed by the courts.
Why not?
I think it is generally unfair to make the taxpayer to front the bill of the government protecting cryptocurrency institutions (via the justice system), especially when the cryptocurrency networks are supposed to be trustless and self-securing. That's basically a net transfer of wealth from the public to a special interest group of cryptocurrency users, and furthermore a rival financial system.
In a more practical sense (some) human opinion is influential enough to make that distinction useless
(Feel free to discuss the fundamental nature of laws with your cell mate)
The "law is law" response to "code is law" is terribly uninteresting. It's just semantic shuffling.
No, not the employee, but the owner. Isn't that a more accurate metaphor for this situation?
In regards to your example if the employee truly does have the power to do that and the intention for that power is not stated. I think it's fine for them to take actions which cause the store to lose money.
Edit: As a sibling comment mentioned it's more like if a owner of the business decided to add these discounts.
In real life this would be the equivalent of buying enough shares of a company to make unpopular changes. Hostile takeovers aren't illegal AFAIK.
So shares are similar to governance tokens in DeFi projects. And in the real world, people also borrow money to get more than 50% of the shares. This is called a leveraged buyout.
However, the difference to DeFi is that shareholders have certain rights (like the right to share in the profits and assets) that are protected by laws. That means a majority shareholder cannot take actions that amount to stealing the company's profits or assets from other shareholders, or they'll be sued. They may do things that the other shareholders don't like, like dismantling the company by selling of parts for cash, but they'll have to fairly share the proceeds.
I mean, there is money moved around all the time, there are more and more clever and complex systems.
But are they connected to the real world in some way?
For example, the stock market is. It lets people with savings invest those savings in companies that produce real world goods and services.
Another example is a bank. A bank can loan money to people who want to spend now what they will earn later.
But DeFi? Is anything happening there that has value to mankind? Or is it all a zero-sum game between crypto traders?
You can invest in cryptos that you think will perform some sort of electronic service, like Ether, in expectation that the value will go up if it grows in usage.
It's admittedly pretty hard to make a connection to the physical world. So staying within the virtual world, ownership is an interesting application outside of finance. NFTs are the most prominent but (as art) least interesting examples of blockchain ownership. More interesting is the intersection with gaming, like what you see with Crypto Kitties and Gods Unchained (deck building game where card ownership and scarcity is blockchain driven). Another example is ENS: decentralized domain names.
> A bank can loan money to people who want to spend now what they will earn later.
This topic is much easier. Finance is the first application of blockchain, and there are tons of traditional financial instruments which exist in cryptospace already.
CDPs[1] offer a decentralized way to borrow money.
Compound[2] offers a way to both lend and borrow.
[1] https://coinmarketcap.com/alexandria/glossary/collateralized...
Can you give an example?
All DAOs are essentially corporations. But not all are legally registered corporations. "LAO" (Legal Autonomous Organization" is the moniker for legally registered DAOs.
There's a few thousand Ethereum based LAOs listed on this site: https://aragon.org/aragon-govern
Also you explicitly say LAO instead of DAO. Under which country's jurisdiction does the LAO fall?
Please don’t tell me about European derivatives like KnockOuts and Warrants. These are more expensive than a margin loan on FTX.
This is in contrast to the current stock market in which only a handful of players have the liquidity and the regulatory ability to market make.
Also open source software should be banned, as everyone can search for security exploits. I see it the same with flash loans, etc. It forces DeFi protocols to safeguard against all attack vectors, resulting in a much more secure environment.
But I think the conversation we should be having is, do we want to move towards more resilient markets, given that the additional security will carry a heavy cost in terms of productivity?
I’m sure there are arguments both ways but it seems like we don’t have the full picture yet.
The various economies in the world show that not all investors create the same results. Restricting big investments to investors who were successful in the past seems to be not the worst idea.
There was enough liquidity in Uniswap V2. A lot of projects incentivize community organized trading liquidity these days. Larger and larger traders are more willing to buy into projects when the liquidity is large enough to support them, but in the past (and simultaenously now in the present, for projects that bother), providing liquidity had a major challenge of both expense and regulatory issues (promising liquidity to potential buyers and actively courting exchanges has been a prong in being designated as a security, but communities expected funds to be used this way anyway, exchanges know this and extort project founders). So now with AMM technology like Uniswap, this has all been solved. Nobody ever has to deal with crypto exchanges again, and communities don't have to worry about liquidity. This has allowed rapid flourishing of some kinds of projects.
Anyway, there are 71,000,000 BEAN tokens in existence. And if you look at the Uniswap liquidity pool, it has risen to around 30,000,000 BEAN slowly over time.[0] And the day the amount got high enough, the person did a flash loan of $1,000,000,000 in stablecoins and bought everything from the liquidity pool, they got 6,000,000 additional BEAN from another source, deposited 36,000,000 BEAN into Beanstalk to get immediate majority vote of their proposal, which gave them all the funds locked up in Beanstalk to themselves (the $80,000,000 or so), withdrew the bean, sold it back into the liquidity pool (resetting the price to what it was before), returned the $1,000,000,000 and kept the $80,000,000 to themselves. ($250,000 to Ukraine Relief to fulfill the promise of their proposal, but they deposited it all into Tornado cash to never have to figure out if that was good enough like in a court) [1]
[0] https://etherscan.io/token/0xdc59ac4fefa32293a95889dc3966828...
[1] https://etherscan.io/tx/0xcd314668aaa9bbfebaf1a0bd2b6553d01d...
If you think they do, you seriously haven’t met genuinely poor people.
Looking at the data it looks like almost no one earns minimum wage aside from waitstaff who get tips on top of it.
Food stamps qualification depends on household size. I got different numbers when I googled but 21.75k a year qualified in all of them if there’s at least two people in your home.
It was essentially a $5 lottery ticket
And yes you can definitely win $80 from a $5 lotto ticket I promise you.