[BUIDL Asia 2023] Price Manipulation of Tokens in DeFi - TWAPs vs Oracles by Mudit Gupta

Transcript

foreign lead security and smart contracts and polygon and today I'll be talking about uh t-vops mainly and how they can be manipulated in practice or how you can avoid uh having t-vops that you have built being manipulated so first of all T what like what is t-bop so I'll start with that t-bop really stands for time weighted average price which means that it's a price of an asset averaged out over a period of time so it's good to like avoid spot price manipulation

um like if you get a price of an asset like right now on this spot it might uh not be its natural price it might be up or down based on the last order but if you get an average price over last 5 minutes 30 minutes or something like that you are expected to get a more natural price uh big D5 projects like maker down make use of it uh they although they do it off chain rather than on chain but just having an average price weeds out those odd data points in spot price so who uses them uh now talking about on-chain TiVo a bunch of protocols like inverse Finance uh use them uh Rari fuse allows them so a lot of refuse pools

like vusd and Float use them bunch of new pools on Euler use them and a bunch of other smaller D5 Protocols are using them there is one common thing between all of these use cases I'm not sure if you if anyone noticed or not is that all of these were hugged in the last one year none of them used them used it properly they all fell into the strap of using risky things without understanding the actual risks so the question is like are devops not safe yeah they're not they never were on chain t-bops are just inherently risky and in most cases the risk is not worth

it there are some use cases with which it might be worth it but let me explain the risks first and then everyone can decide if it's worth taking on the risk so the follow-up question to that would be like who uses them securely and the answer is I don't know if you find out anyone who uses on-chain tivob securely please let me know I've not found a single project uh that does it and have not has not been hacked so far uh everyone who uses them has been using it poorly and gets wrecked and you'll understand why it happens I'll talk about the risks now so there are many risks um like associated with devops um but before going out let's talk about

how tivobs are manipulated how they actually work and so on so for that uh let me explain how uni swap pricing works and I know this is going to be a little technical so uh please bear with me while I go through the explanation so here you can see unit swap follows a price curve which is X into y equal to K which basically means that the amount of asset a multiplied by amount of acid B should remain constant so if you buy a lot of asset a let's say x then the price of asset X should go up if you buy a lot of asset y then the price of asset y uh goes up and vice versa if you sell

a lot of asset X the price of asset X goes down if you sell a lot of asset why the price of asset y uh goes down and the multiplication of both is always same so one goes down one goes up the constant Remains the Same and that's how the pricing algorithm works and here um the diagram shows three different invariants we only need to focus on uniswap for now that is represented by the dotted line on the top I could have used a graph that only has that dotted line but unfortunately this was the easiest graph to find so here we are now here let me explain how to actually manipulate price uh now as I said if you

buy an asset the price goes up if you sell an asset the price goes down so if you want to manipulate the price of an asset on the upward side all you have to do is buy a lot of that asset and uh that that will just shoot up the price immediately and once you have short up the price you can do your manipulation and at the end you can sell the asset back to the pool uh for a high price as well so you don't make any loss let me give you a more practical example let's think about a lending borrowing platform like our way is not vulnerable to this they use chain link oracles for the most part you can't manipulate them

in the same way but let's consider a scenario where a protocol like away uses uh spot price on uni swap for pricing their asset it has happened in the past a lot of protocols have been hacked in this way but let's theorize for now so what are we lets you do is you deposit some collateral asset and then against that collateral you can borrow some other assets so let's say you are depositing eth as collateral now eat price right now is maybe eighteen hundred dollars I'm not sure it keeps moving way too fast but let's assume it's the right price is eighteen hundred dollars so you put in heat as collateral as you put in one need the price is

eighteen hundred dollars so you can borrow assets uh worth maybe twelve hundred dollars from the pool assuming LTV of 66 percent so eighteen hundred dollars collateral allows you to buy twelve hundred dollars of collateral uh worth of assets all good so far if your debt increases more you will get liquidated the protocol will sell your eat which is worth 1800 to recover your debt which is worth maybe twelve hundred thirteen hundred so protocol will not make a loss but what if you manipulated the prices so in this case you deposit one each in our way but then you go to UNI Swap and you buy a lot of it from uniswap now suddenly each price on unisoft shoots up

it goes to ten thousand dollar let's say and uh like you have bought it for as much as ten thousand dollars from uni swap which means you have overpaid for your eat so right now you have an impermanent loss let's say you are temporarily in loss but now what you can do is now you go back to our way uh tell it hey I deposited one eth in your protocol look at the prices it's worth ten thousand dollars let me borrow seven thousand dollar worth of assets from you please and Away we'll see oh yeah it's worth ten thousand dollars if I give him seven thousand I can still liquidate and get my money back I can sell this ethon unit Swap and get my money back so how it gives you those assets now now what

you do is you go to Junior Swap and you sell back the eat you just bought the eat you bought for as a high as ten thousand dollars you sell it back and you get all of your money back because basically the price follows this curve when you bought the asset the price went up when you are selling the asset the price goes down so at the end you make no loss it's the same amount of assets you started with except the feast unit swap charges uh usually in unisa V2 it was 0.03 percent and in the latest version it can be as low as 0.01 percent so you lose 0.01 percent let's say in fee but you successfully manipulated and

all of got all of the assets back now looking at away situation now they are in a situation where they still have one eat as your collateral worth eighteen hundred dollars but they have loaned you out uh seven thousand dollars worth of assets uh we can't liquidate you now not to the full extent at least even if they uh sell your one needs they only get eighteen hundred dollars back and they are still at a loss of uh fifty two hundred dollars so away just lost fifty two hundred dollars you're not gonna go back and give them seven thousand dollar you're not gonna pay back your debt of seven thousand dollars to get back your collateral so away has some bad debt which is basically a loss for them so this is an example of how

spot prices on uniswap can't be can be manipulated so everyone now understands this and almost no protocol in the wild uses spot price for pricing assets uh so people started thinking hey spot prices are not safe what can we do next so they came to tivops time weighted average price so instead of taking the price directly in that block which might be manipulated by you protocols now State started taking price that is averaged out over last five minutes or last 30 minutes and the reasoning is you can't have it have a price be manipulated for so long otherwise someone else will Arbitrage like if you buy and ask by eat or buy lots of eat from uni swaps as the

process that the price goes to ten thousand dollars the expected expected outcome is that in the next block someone will someone else will come in and just sell it to UNI swap someone can buy each from banance for example and sell it to uniswa for profit and just Arbitrage the difference so the price on uniswab won't remain too high for long um and that is why t-bops will give you a more accurate uh price than spot prices in theory this is great this works out and devops in fact are better than spot prices but people assume they can't be manipulated which is wrong there are lots of risks and attack vectors with t-bops that we can talk about now

so first of all people reason that cost to maintain the imbalance is super high in unit swap people say that to maintain an imbalance you need to make sure that nobody else can Arbitrage it back so you need to First create the imbalance by buying a lot of Ethan uniswap and in the next block you need to fill up the block with your transaction so that nobody else can Arbitrage nobody else can bring the price of it back down and to fill a block it does cost a lot of money it can cost you almost equivalent to the profit you might be making um so it's a significantly hard task to

maintain the imbalance theoretically but the problem is that there are lots of loopholes here one is people assume that you have to maintain this imbalance for five minutes to make it effectful and to affect a five minute devop it's not the case it's an average price even if one data point is higher the average is going to increase that that's how maths works so you only need to really manipulate one block to get the high price uh so you don't need to maintain it over a long period of time uh similarly there are other ways to uh like change the make it cheaper to manipulate

that I'll talk about for example instead of uh like filling up the next block you can think about 51 percent attacks uh when ethereum was proof of work it used to cost only 15K per block uh to do a 51 percent attack for example so you could have just spent theoretically spend 15K and then a 51 percent attack on ethereum to maintain your imbalance it has other it's not as easy as just paying 15K to someone to do it because you need a lot of compute power so you do need those resources but then there are other ways to do it and especially with proof of stake it's actually easier uh we'll talk about concentrated liquidity so when manipulating uh prices

this graph I was showing earlier was for units of V2 it's just a straight graph like it's a straight line you buy as many assets um as you can and the price uh goes up or down in the same ratio but the thing is with concentrated liquidity although the price graph is the same the liquidity is concentrated in the current price zone so actually you don't have to buy it for much more than its current price all of the liquidity is around 1600 to 2000 dollars so you buy it for let's say two thousand dollars and suddenly the price will jump for ten to ten thousand dollars because there is no liquidity in that range

um that's our unit of V3 works and this means that the capital you are putting at risk by doing this is quite low you're only paying a premium of 200 versus a premium of ten thousand dollars let's say on it so a concentrated liquidity makes it cheaper or reduces the capital requirement uh then yeah people say that evops allow you to take average price over a long period of time it does but this is how math works it's an average formula if you have infinity and then you add 10 terms after this and then average them it's still Infinity that's how math Works people can understand that and by this you will see even if you manipulate the price on one

block it's likely that the net outcome will still be manipulated not to an extent uh that you can manipulate a swap like a spot price but it can still be manipulated a lot and for Protocols of which deal in stable coins for example this can be devastating if you manipulate the price um so away allows up to 97 LTV on stable coins e-mode if you manipulate the price more than three percent which is not a big deal if you manipulate the price of a stable coin more than three percent you you can liquidate a bunch of users on our way you can do some nasty things fortunately our way doesn't use on chain T watch so it's not that easy but theoretically you can by just three percent manipulation

and then what made it cheaper was 0.01 percent fee pools so earlier it used to cost 0.03 percent to go up and back down now it only cost 0.01 percent so the attack is even cheaper um the other thing is people depend on liquidity a lot to imagine the cost of an attack um so if you look at the unit swap pool it has 100 million in liquidity so you have to buy out uh 50 million of eat let's say to do the attack but the thing is the liquidity is probably not yours what if the liquidity is just from the attacker who's baiting you to trust it uh and they just withdraw the liquidity and then manipulate the price you can't trust that liquidity unless you are the one putting it in

um so that that's another external risk that people do not think about they just look at liquidity oh it's high liquidity must be expensive to manipulate that liquidity is not permanent uh it can go away any day not just for malacious reasons but like for example Sushi swap did a vampire attack on uniswa which stole a lot of liquidity from uh uni swap what if that kind of situation happens again and the liquidity just moves elsewhere you will become vulnerable again what if uh like U.S government has been doing crazy things lately like sanctioning tornado what if the sanction unit swap for whatever reason your liquidity will just go away immediately and then you're stuck again so liquidating on unit swap

you just can't trust it and emerge so I initially talked about 51 percent attack and the cost to it but it was still probabilistic and you need social consensus and things like that the merge removes those concerns it actually makes it super easy to manipulate the reason is that in after the merge you know exactly when you're gonna mine a block you know you can know in advance that I'm guaranteed to mind block n and block n plus one and when you have this guarantee you know which you can include your own transactions and nobody else's transaction in those blocks and you can easily manipulate uh prices over multiple blocks so if you know I'm gonna be mining block n and n

plus 1 I can start the manipulation at start of block n and finish the manipulation at the end of block n plus one in a guaranteed way without any cost to me it costs me nothing not even 15K nothing and the price can be whatever you want the thing here is that it's unlikely that a solo player will have enough stake to get Block n and n plus 1 like consecutively it's it's very unlikely from a probability perspective but the thing with ethereum is that there are very few solo stakers most of the validators are run by Lido or coinbase and they very they have such

high stake they're actually very regularly get consecutive blocks so if any day coinbase or Lido go malicious for example they can drain any protocol that is using TiVo without any cost which implies like coinbase being a regulated entity if any day like the US government comes to them and orders them to do it uh they will have to do it like there's no way around it so at the end of the day then you start if you are using TiVo you are basically trusting decentralized entities uh to be honest and not manipulate your protocol and if you are doing that then might as well trust a more centralized Oracle like chain link or band protocol or

something like that because those you still maintain the centralization or risk there but at least they don't have the other pitfalls that t-bops have so I hate your choice uh what to use then the final bit here I'll add is that the risk management of devop is so complex I've only gone through some of the attack vectors and concerns I share but there are many more and not even Guinness Foundation actually understands all of it um or cares to go into details about those things an example is like these guys just this month uh with uh working with another company released a risk assessment dashboard which helps people

quantify the risk of manipulation of a t-bop Oracle which is super nice it's a good start but the problem with that that is that they underplayed the risk by a lot because the methodology they used uh just didn't count for the complete risk and I call them out uh like a few times these are some of my tweets for example to manipulate a usdc usdt pool they made an argument that hey if you want to buy 40 million dollars worth of usdc you need to spend 40 million dollars worth of usdt theoretically sounds good but practically doesn't make any sense

because you can Loop you come with just one million dollars of usdt and you buy one million dollar of usdc from uniswap then you go to curve you sell that one million dollar of usdc get back one million dollar of usdt and then your incentive you go back to uniswa buy one million more go to curve sell it go back to UNI swap buy one million more and so on so with by leveraging your buys on stable coins in a 40 million liquidity pool you can just spend one million dollar to empty out the pool so when uniswab on the dashboard says that it cost 40 million dollar to manipulate the USD to usdc pool which is their highest volume pool they're just outright wrong it actually

costs just one million they forgot the how to that you can leverage and Define a single transaction in fact you don't even have to look you take a flash loan and then you show up it's just three transactions um nothing more so in their research their numbers are right based on their methodology and it's a good start I give them that it's better than nothing but there are cheaper ways to do it and the attackers are gonna use the cheapest way they're not gonna use the standard research oriented method methodology attackers are gonna use the most practical way and the other thing Unison did wrong was they only focused on uh this liquidity amount that how much usdt you need in your wallet to manipulate the pool they

didn't focus on how much it will cost the attacker um and in fine D5 you know like getting this liquidity is super cheap there are like almost every hacker who has hacked a major protocol in D5 and pass has one million dollars lying around in their wallets uh like folks just a little north of air for sure have over 500 million dollars on their own chain wallets so if it cost one million or 40 million dollar in liquidity that is not uh like at risk or which is not the cost it's irrelevant people will get that money back after they exploit so they'll just put it down they'll do the exploit they'll get it back the cost factor is

more important if it actually costs someone to do on to spend 100 million to do an attack they and they won't do the attack till their profit is 100 million but if it's only about liquidity doesn't matter like I'll use my one million dollar liquidity to make a thousand bucks in profit and I still have like a super high APR uh on that one million dollar it's like getting interest on that um on those dollars setting idle so um and yeah for various other reasons this dashboard shared by uniswap this month just doesn't cut it and that that's my whole reasoning that devops are just a technology they can there is nothing wrong with them but people don't

understand the risks associated with them well enough and they start using them like in not the correct way and when you use them in not the correct way you get hacked basically as the protocols I talked about initially in my slide everyone who has been using them so far is an on a super high risk of getting hacked it's like walking on a Minefield if you put one wrong step boom you are gone you might cross the whole Minefield without getting blasted like you might go through it even if you don't know all of the risks like you don't know where the minds are exactly and you can still make it through based on luck if you know where all of the minds are then yes it's a higher chance

that you will make it through without uh being blasted so like if you are gonna use Steve op make sure you know where the minds are don't just know half of the minds and then say Oh half of the minds will play it on luck but ideally just don't go in a day in in a landmine why do you why do you want to go and risk it in a landmine there are better Alternatives you can use so what are better Alternatives traditional oracles so these uh the caveat here is that they are not ideal they are still centralized uh for example if you are using uh you're using chain link you're still trusting that chain link validators are secure and uh

you're still trusting that the chain link uh validators are secure they were going to introduce links taking on that to make sure security is derived from link even if they do it then you have to assume that link holders are safe and secure and so on so there are some uh like rests here as well but the thing is your in this scenario in worst case you are trusting a centralized Authority this is the worst case for a traditional Oracle but this is the best case for a t-bop in t-bop as I explained before you're also trusting validators like Lido and coinbase and in fact you are also trusting operators like flashbots for example flashbots has over 80 percent of network control on ethereum a

flashboat goes Malaysia starts doing this in their node then yeah same result so you're still trusting centralized party in t-bops and at the end of the day it's your choice I would recommend going with a traditional oracles if you can but if you go with t-bops make sure you understand their risks properly and I'll just wrap it up there thanks for listening and if you want to reach out you can reach out on my Twitter or have my contacts through my website or you can reach out to polygon directly thanks for listening in foreign