# Security Risks in DeFi: Delineating Technical and Economic Security | Devcon Bogotá

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2023-10-07
- Duration: 27:47
- Watch: https://streameth.org/watch/yt-1Gw0jb52plM
- YouTube: https://www.youtube.com/watch?v=1Gw0jb52plM

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/security-risks-in-defi-delineating-technical-and-economic-security/

The frenetic evolution of DeFi makes it hard to understand its principles and risks. In our talk, We delineate DeFi along the axes of primitives, protocol types and security risks. We distinguish technical security, which has a healthy literature, from economic security, which is largely unexplored, connecting the latter with new models and thereby synthesizing insights from computer science and economics. Finally, we outline the open research challenges across these security types.

Speaker(s): Daniel Perez, Ariah Klages-Mundt, Lewis Gudgeon
Skill level: Intermediate
Track: Cryptoeconomics
Keywords: DeFi,Security Risk,Incentives

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

foreign [Music] hi everyone and thanks a lot for coming to our talk so I'm Daniel and with me here is Ari and this is a prize that has been done by a few people so there's Sam and Louis who are in the audience but I won't be presenting uh here today and so today we're going to talk about uh secretarist in defy and in particular we're gonna try to sort of give some definitions and explain how technical security and economic security are different or how they differ uh so a quick outline of um what we'll be presenting today so this talk is meant to be fairly accessible so we'll start by presenting a bit the different Primitives using defy and then we'll present a couple of protocols that are um that can be built or and once we've done this we'll enter a bit more into the main part of the talk which we'll be explaining what technical security and economic security is and we will finally present a few open challenges for research with the focus of on these different types of security so I will start on a very high level but what is D5 so we have a couple definitions properties for D5 so the definition of a give is a peer-to-peer powered Financial system and for a typical D5 we're saying that it should have a few idealized properties uh first one being non-custodial which means that participants should have control on over their funds at any point in time and the next one is that it should be permissionless anyone should be able to participate in this financial activities without restrictions or without being able to be censored by a third party um should be openly auditable which means that anyone can look at the blood state of the blockchain or what is powering the defy and be able to see the transactions and what is going on and finally it should be composable which means that different protocols should be able to communicate with each other and to interact to form sort of new Financial systems on top of this um so well with this D5 coming there has been a lot of controversy and all and we can see this a bit as like two sort of very point of views and optimistic and a pessimistic point of view for the defy Optimist defies a huge technological Advance this is new Financial system that's openly editable and that has all the properties listed before and that's obviously very promising for the future sure and there has been already a lot of good things with D5 for example stable coins like die has been used in countries like Argentina to fight inflation any sort of things and also we have seen that more custodial system has tend to fail in some places where um decentralized Finance could could have allowed people to have more visibility on what was going on the other hand there's also this pessimistic view that is that well defied and regulated its hack prone um there it can allow people through its southernmost nature to to commit many sorts of crime like scamming money laundering and so on and well there had also been like many hacks as probably you have all seen um and this North Korean hackers hacking protocols and also um recently a bit more recently the crypto mixer uh being sanctioned um and and so on uh so well in this talk well we'll we'll focus mostly so on security which is uh something that we think is absolutely uh it's a complete must for um the defy the vision of the defy Optimist to be fulfilled and really what we'll be trying to do is to to differentiate between what is technical security problem and what is an economical security problem uh before this we'll give um a bit of background around like different Primitives that are needed for all this and we'll start with some very basic assumptions here is well all Z by protocols rely on an underlying blockchain and it assumes some security properties which are consistency integrity and availability and they're gonna be any D5 without disease to begin with um then it uses a few other properties of the blockchain and here one that I want to highlight because it's very there's a lot of sort of security issues because this are like um many potential let's say it's atomicity which means that if a transaction starts it will either succeed completely or it will revert but there cannot be a half transactions that just cannot be and and obviously D5 relies on Smart contracts which are um programs that run on the blockchain um and using these Primitives there are a few really um essential piece of software um and of other Primitives that are required for defy first one being oracles so because blockchain cannot have access to off-chain information somebody needs to take this option information and put it on chain and um and these are called oracles and are used for example to to get price of say USD because this is not an information you could possibly have then there is governance which is used typically to upgrade D5 protocols with time change parameters and these sort of things um then we have Keepers which are off chain sort of bots and that will submit transactions to update States this is because um in most blockchain systems you need a transaction to be able to perform any sort of State transition and therefore somebody has to take care of this and finally there are many Market mechanisms that are used in D5 there are collateralization where people will put somebody at stake um to make sure that you can hit the default on the position for example um then there's arbitragers there's also liquidations equations which are used if somebody does not have enough collateral for whatever position so that covers roughly um the main primitive that we'll need in D5 protocols and now I'll present just a couple of the five protocols probably some most of you are already familiar with these but just to highlight a few properties um so that we can kind of all be on the same page to start talking a bit more about the security aspects um so there are many types of protocols but we don't really have time to go through all of them so we'll first start with automated micro makers uh which are decentralized on change electronic changes because on chain it's way too expensive to have some order book based um uh dexes amms or somehow has become extremely popular and they have a lot of good properties a few properties are less good but the main idea is that people will come and provide liquidity to a pool that consists of typically two or more assets and by providing these liquidity they in some way commit to a portfolio of these underlying assets and a portfolio that will be rebalanced by arbitragers that will try to keep the prices consistent with some um all other off-chain for example prices or prices on some other exchanges once that is done people can trade through this pool and that generates fee for fees for the pool and typically this is profitable in the case where they are volatility harvesting when it's it was talked just before was a lot more advanced than this but basically it's if the price is around some line and going up and down it's typically profitable as opposed to if the price is consistently diverging then maybe not so um and it there's still some risk and especially strategy risk and adverse selection risk involved with these amms um and another very important uh type of protocol for D5 or protocol for low limit funds also called lending protocols which are Unchained markets where people can borrow and lend assets so typically people will come and deposit some assets that are pulled in smart contracts other people can come and borrow these assets and to do so they will need to be over collateralized so they cannot default on their position um an interesting thing is that um their algorithmic interest rates um and which means that typically with this Market there's no duration risk um and if a borrower would default on his position which means his collateral ratio is not high enough anymore he can get liquidated um based on rules are imposed by the protocol and a final Point that's also very sort of typical to defy um our flash loans that's quite an interesting primitive because it's allowed people to um um borrow money without having any under collateral at any collateral and um the condition for this is that they repay uh this loan in a single transaction and this works mostly because of the Primitive I described before which is atomicity um so with all this then these protocols can communicate together as I mentioned earlier and for example one person could deposit some money in an emm and get some LP shares and use this MP shares for example in lending protocol as collateral to be able to borrow some other type of asset and that's a very interesting thing with D5 that all this protocol can really very easily communicate um so now that um I'm done with this sort of um intro background about defy itself we'll dive a bit more into uh the security and we'll really try now to to um delineate Technical and economical security um and first we'll start with some informal definition and um so we say here that for protocol or smart contract to be technically secure it needs to be secure from an attacker who is limited to Atomic actions and we're like here being secure has been going to get exploited we have a more formal definitely exploiting paper that we'll show at the end but for for example it could be not to be able to sell assets and so here Atomic actions means that the action would be either a single transaction or is there a bundle of transactions but the property needs to be that all these actions will be executed atomically um and because of this so technical um so attacks on technical security are risk-free because basically the attacker can just perform the attack and at the end of the transaction or of this Atomic operation he can see if yes or no he made money and if he did not make any money but if he made money he profits if he didn't he'll only pay the gas fees and can revert the transactions so by definition um or by kind of extending the definition a technical attack will always be risk-free otherwise it it will fit our other type of attack and so there are some examples of um tactical attacks are Atomic Mev sandwich attacks and for example like reference C or also attacks that exploit logical bugs and that's all now fairly well studied we know more or less how to protect against these they're of course like testing smart contracts very well in program analysis or formal methods and these are in general uh the better studied one so smart rank vulnerabilities we have re-entrancy interior manipulation logical bugs all of which are right now quite well studied there are single transaction sandwich attacks which is where if a protocol say would use the spot price of an amm to to use as a price in their protocol an attacker could come and in Balance the same so that when the protocol would try to look up the price it would get the wrong price and under attacker could fairly easily exploit this to make money or governance attack if it's possible in one transaction to do some governance action that could come probably borrow enough governance token to do so and execute some malicious proposal uh lastly there are a transaction ordering attacks so frame will displayments attacks where an attacker could front run some particular transaction to make profit instead of the person who initially initiated this transaction and also multi-transaction sandwich attacks which are an attack in where an attacker could come and see that somebody is trying to swap but have for example a very high slippage tolerance and he could invalid the pool before to give the the victim a bad price and then rebalance the people after and would get the profit that the victim lost because of the of the price he got so now I'll give it to Ari so that he can talk about Economic Security so the other type of security uh we Define a protocol is economically secure if it's not profitable for an attacker who can perform non-atar non-atomic actions to manipulate the protocol into unintended States uh that where they can essentially like extract assets from the protocol or cause other sort of Mayhem in the protocol and so Economic Security is about where you have an exploiting agent who's trying to manipulate some sort of incentive structure of the protocol to profit like by stealing assets and since these are non-atomic they have upfront tangible costs and are not risk-free basically you have to like set up set it set up the attack and then actually perform the attack later on and something could happen in between that those two those two times and basically something the attack could fail if something happens in in between those those two actions and such as the market responding or other agents responding and to address this we really need to have economic models of what's happening in between these transactions and the attacker would need to to understand this and basically manipulate what's happening in between these transactions so let's hammer down a little bit further what the difference is between Technical and Economic Security so in a technical exploit we have an attacker who's effectively finding a sequence of contract calls that leads to a profit and these are either in a single transaction or a bundle of transactions but it's being done all at once or not at all and for these formal models of contracts are basically enough so to say although it can still be quite a hard computer science problem to work out sort of optimal uh the optimal ways for attacks to be performed in comparison an economic in an economic exploit uh an attacker is performing multiple actions kind of at different times or really different points in the sequence and they don't necessarily control what happens between those actions and so there's no guarantee that the final action is profitable so there's kind of a setup there's uh actually performing the attack later but in between some sort of Market can respond or other agents can respond and so the attacker doesn't really know if uh if it's profitable uh at the end and for this we need models of what's going on in between um which is a bit different than just formally verifying contracts and so this is kind of an open area of research especially around kind of understanding liquidity of markets so what's hammered on even a little bit further with like a very simple example of something that'll be a technical exploit and then something we can change a little bit about it that turns it into instead an economic exploit so in the example of a technical exploit let's say a protocol uses an instantaneous amm price as an Oracle and that then an attacker performs an atomic sandwich attack uh to steal assets from that protocol because this can be done atomically this is a technical exploit but we could change it we could use a smarter choice of Oracle so that this isn't possible and that leads to instead it being an economic exploit so here consider that the protocol instead uses a little bit smarter choice of uh of Oracle a Time weighted average amm price but these can still be manipulated over time but it involves risk for the attacker but they still may be able to steal assets and actually something like that just happened very recently in in mango I believe so we can see this also like in in data about what's been happening in different protocols so one example here to kind of illustrate this a little further is something that happened in compound in November 2020. now this wasn't really clearly an exploit but it kind of illustrates what could have been an exploit and what can be exploits in other protocols so basically the price of dye was trading on on coinbase and for a very short period of time the price pumped to a dollar Thirty and because compound was using uh coinbase as an oracle this allowed a lot of liquidations to be possible on compound and that cost a lot of a lot of LP's money and compound and opened up a lot of opportunity for profit from liquidating those positions now this wasn't clearly an exploit but you could imagine that somebody might set this up intentionally manipulate this Market that manipulates the Oracle price and then profiting from the uh from the resulting liquidations and that's essentially what we've seen later as well so in a clear exploit something similar happened in Venus in uh in May 2021 where the the Venus Market was was manipulated and essentially the attacker was able to leave the protocol with a lot of bad debt and again just recently something similar happened also in mango so how do we what are the tools available to like help to fix Economic Security and and make protocols more secure one of the first ones uh the biggest is really over collateralization uh and here um it just doesn't come without risks though and so it's very important to include uh an analysis of the the actual economics in designing and calibrating your your protocol so for instance you could have persistent negative shocks that affect collateral prices and you could also have kind of illiquid markets around those uh uh those assets and this can lead to loans being undercoateralized and the system being left with bad debt uh it can also lead to situations where it's unprofitable for Liquidators to actually initiate the liquidations uh which then also can lead to the protocol having bad debt because the liquidations don't happen in time and there's also sort of issues that can happen with stable coins and deleveraging um of these stable coins like we saw on on in die on black Thursday where you had this like short squeeze effect and you also had this sort of like uh collapse of the of the liquidation engine some other things that you need to be aware of when you're designing protocols with respect to Economic Security is the minor extractable value that you can be can be setting up I won't go too in depth here because there have been a lot of great talks already about Minor extractable value I'll just point out that defy applications tend to give many new sources of Mev and you need to be considering these and this is essentially coming from Arbitrage opportunities so for instance in uh indexes you can have sort of like stale order quotes and whoever fulfill those is able to do an Arbitrage Loop and profit and in lending protocols uh there's usually a a liquidation incentive and if you're the person who can come come in and perform the liquidation when it's uh when it's allowed then you can profit from from being the person who does that and this can lead to consensus layer risks um if this Mev is greater than the block reward another important area is in the design of governance and the risks that can come up from your governance layer um so the governance is basically introducing a way to upgrade protocols and these need sort of careful guardrails and careful design so that your Governors aren't going to have missed incentives to do things that are actually bad for protocol users and so commonly governance may not really be incentive compatible with the actual users of the protocol and this uh this can be an issue they may not act in the interest of these protocol users and to illustrate a little bit in some sense Governors have some honest uh cash flows but these cash flows may not always be very high sometimes they can crash and then if they do crash the region of incentive compatibility might shrink and it may be more profitable for these Governors to instead of doing uh sort of honest actions and upgrading the protocol in good ways to instead decide to attack the protocol and basically steal assets from the protocol or do other things that put protocol assets at risk and the costs to do this can sometimes be very low in D5 and should be part of the design of governance systems so for instance tokens Can Be borrowed and agents can be sort of anonymous and this can lead to low costs to uh to actually do these governance attacks the last one I want to hammer down a little bit on is this what we were talking about in the examples of where you have markets or Oracle manipulations that can directly affect your protocol so here we need to distinguish between uh one a market price that is being manipulated but correctly supplied by an Oracle and two an oracle that is itself being manipulated so in Market manipulation you have an adversary who is manipulating the market price either on or off chain depending where that market is is occurring uh over some period of time and they can profit if uh if they can uh if if the manipulation they can exploit it in in a protocol that uses uh that market as an Oracle and these problems persist even if the Oracle is not an instantaneous amm because it's just there is some liquidity in the market depending on that liquidity uh there's some cost to affect the market price and you can instigate uh changes to market price that are then reported through the Oracle system and importantly though this is risky because you have to do it over time it can't be Atomic which is again the main point about Economic Security and this compares to Oracle manipulation where uh it depends on the design of your Oracle but even if the market price is not being affected uh the Oracle might be reporting incorrect prices so centralized oracles have uh potentially a single point of failure and you might want to control for that in designing your protocol and on-chain amm based oracles as we've seen can be manipulated and so the costs of manipulating that depending on the liquidity in those markets is something you should be carefully considering and other decentralized Oracle Solutions are really imperfect for the issue that you can't really verify the correctness of prices on chain and so it's quite an open problem how to do this very well so that sort of concludes our discussion of uh Technical and economic security but it leads to a host of new uh research challenges that are really going to be important for securing D5 protocols into the future so I'll give you just like a quick a quick flavor of these one is around composability risks mostly these are not very very well Quantified but a lot of program analysis can be done to uh to understand these risks a bit better and then to design your protocols in ways where uh where how you're composing with other protocols is as safe as possible another is what we were just talking about this governance sort of risk and modeling uh the incentive compatibility of of Governors and sort of modeling out what we call governance extractable value and trying to understand when uh our Governors and your system incentivize to do things that are good for the protocol and how do you stop them from doing bad things and these need economic models about how these governance systems work over time and how the agents make decisions another is around oracles uh so um basically a similar sort of role as governance incentive compatibility to report uh correct prices and then in a fair amount of work to be done in in Mev and there's just one illustration of sort of like what makes Mev very hard is that um if you're if you're looking at just intrablock Mev Atomic Mev this this becomes an optimization problem that resembles knapsack but where the items in the knapsack can change depending on the current selection so it should be even harder than knapsack and so it should be an NP hard problem and this becomes even harder than if you're looking at interblock Mev and this includes cross chain Mev because now you have to look at an inter-temporal version of that of that same optimization problem and there's also a lot of work to be done in sort of making Anonymous D5 protocols and preserving privacy so that brings us to the end of the talk uh just as a quick recap we've covered how defy has several Innovations but it also has several risks and to fulfill the verse the the vision of the D5 Optimist we really need to make sure that Defy is secure and to do that we've delineated uh two types of security risk between Technical and economic security and the key distinctions that uh that allow this to be useful are that it's based on atomicity and it really tells you a lot about the models you need to understand Security in your teeth in your D5 protocol and the types of models that we as researchers need to build out so thank you and let's open that up for questions if we have time just while we're waiting for the mic um so this is based on the paper that we wrote and this is a QR code in the link if you want to have a look and there are more formal definition in there so please feel free to take a look um so how does this overlap with a lot of what gyroscope is doing and sort of your mission and vision um the super super curious about that yeah that's a great question so how we've designed uh so it's a gyroscope we're working on a new stable coin project we're building a bunch of different uh Primitives that allow what we think is a more resilient uh stable coin design and it's really coming out of all the research we've been doing we've set up some of the initial models that like helped understand for instance Economic Security and the mechanism design that went into gyroscope takes all of that knowledge into consideration and tries to do uh the best mechanism design that we can considering uh how we understand Economic Security today thank you so much remember the menu will be open this weekend so come and talk with the people with everyone close deals Etc