How 2 DeFi Attacks Made Almost $1 Million in Profit - Ep.113

Transcript

Hi, everyone. Welcome to Unconfirmed, the podcast that reveals how the marquee names in crypto are reacting to the week's top headlines and gets the inside scoop on what they see on the horizon. I'm your host, Laura Shin. Crypto.law, aka Kelman Law, is a New York law firm run by some of the first lawyers to enter crypto in 2013 with expertise in litigation, dispute resolution, and anti-money laundering. Email them at info at kelman.law. Crypto.com, the crypto super app that lets you buy, earn, and spend crypto in one place. Download the Crypto.com app today. eToro is one of the largest trading platforms in the world, with over $1 trillion in trading volume on the platform per year. U.S. customers can trade the most popular crypto assets with transparent fees. Create an account today at eToro.com. That's E-T-O-R-O dot com.

Today's guest is Lev Livnev. a formal verification researcher at dap.org and a founding partner at Symbolic Capital Partners. Welcome, Lev. Hi. Hi, Laura. The crypto community has been talking about two big exploits or hacks or attacks or whatever they were on BZX in the last week. Can you give us a brief overview of what happened? And afterward, we'll dive into the details on each exploit. Sure. So the first thing that happened that's been in the news is... on early morning on Saturday or late night on Friday, depending where you are, there was a transaction that did something quite unusual with the smart contracts on BZX. And

one of the kind of most notable things about it that jumps out at you at first before you can figure out what exactly is going on is that this thing interacted with a bunch of different protocols and was also moving quite a lot of money around, much more than you'd see in a typical transaction that used any of these features. So kind of in brief, this transaction started by borrowing a lot of Ether from DYDX using their flash lending facility. I then called into BZX and opened up this huge leverage position, so a much larger leverage position than the smart contract would typically be used for. And at the same time, or rather straight after that, it also opened a position on Compound and used some of the ETH collateral that it borrowed to borrow Ethernet. an asset called WBTC, wrapped Bitcoin,

which was also the asset that was involved in the transaction in BZX. And then straight after that, after whatever happened inside BZX, it then did another huge trade on Uniswap using the wrapped BTC that it just borrowed. And then somehow at the very end, they were able to close out this whole operation by repaying the flash loan that it started with. And then they'd come out with assets at the end of it that they didn't start with, right? So this was the first thing that was noticeable here was that something was very wrong. And the second exploit did something similar where, again, they were able to make off with a lot more money than they were leaving behind, even though in the flash loan model, what should be happening is that you repay the loan. Is that kind of how you

would characterize it? You're right. So the second attack was kind of similar. It was actually a little bit simpler. And in both cases, it's important to note that the issue, all of the flash loans that were actually issued in the first case and the second case were properly repaid. So essentially, there was never a bug in the flash lending functionality of any of these protocols per se. So the key promise with a flash loan that you repay the loan at the end of the transaction, this all happened. Really, where the Where the danger came from was that these flash loans were used to finance essentially, well, essentially what I would just call a straightforward smart contract hack. So a hacker exploiting smart contract vulnerability, but the sort of vulnerability that actually requires you to have capital upfront in order to be able to exploit it.

And in both cases, flash lending was used to finance this essentially by an attacker who didn't need to bring any of their own capital to the attack. And so you're saying that flash loans aren't really the problem. So what, when you say this smart contract vulnerability, what was that? Right. So in the first case, and I mean, I think both of these are actually fairly, you know, I would just definitely describe both of them as fairly subtle issues. So it's not easy to kind of, you know, just satisfyingly, you know, summarize it in a few words, but to attempt to summarize it in a few words, the first one kind of took advantage of you know, basically, I think, in my opinion, two separate facts about the BZX smart contracts. The first one is that essentially, you know, these smart

contracts that were used for opening leverage positions, you know, used external exchanges in order to source liquidity for trading, right? So BZX, if you want to open a leverage position, you actually need to do some trading in order to accomplish that. And that means, you know, Essentially, you send in some assets, you maybe borrow some assets, but then you go out somewhere and you do a trade in order to actually open this position. And so the first issue that I'm referring to is the fact that essentially these smart contracts were quite comfortable opening a huge leverage position and doing a lot of trading without any regard for the slippage that they were creating. So essentially, these trades had very, very high impact on the exchanges where they were being executed.

And even figuring out how those trades looks was a little bit complicated because VZX is connected to a decentralized exchange called Kyber in order to do these trades, but Kyber itself is then connected to other decentralized exchanges. In this case, Kyber was actually routing these trades to an exchange called Uniswap. Then what was happening in effect was this huge trade was being routed to Uniswap. When they were executing on Uniswap, they were generating huge slippage. Actually, the price at which the trade was executing was much, much poorer than the market price just because the size of the trade was so large relative to the liquidity available on that exchange. So this is where the first issue came from, is essentially these trades were generating huge slippage. And the smart contract, in my opinion, wasn't really designed to handle this in the right way. But where this became really bad is the fact, the second issue is that if the

trade actually generated enough slippage, then it could cause the entire trade the entire position to become insolvent from the beginning, essentially, because there was supposed to be a safety check at the very end of opening such a position that checks whether or not the position ends up being safe. So essentially, whether the position is subject to liquidation when this position is created. And the check is of course supposed to make sure that you cannot, the position is not subject to liquidation after being created because you want to only be able to open safe positions. But it turned out that this check was actually just completely incorrectly implemented. So there was a, what I would call it as basically a straightforward logic bug just in that check where

this check was actually never being made in this situation. So with any position that anyone had ever opened on BZX, I think in these particular circumstances, the check was not happening. If you're able to incur enough slippage in one of these, when opening one of these positions, you could make this position underwater. So I just want to clarify something. I did see in a BZX blog post that they essentially said that this was an issue with flash loans and not with their platform, that a similar thing could have happened on DYD, using flash loans with DYDX or on AV, I think it's called AAVE. I'm not sure how to pronounce the name of that protocol. but are you saying the opposite that actually it is um due to a vulnerability in their particular smart contract uh yeah so i there's a couple

i think there's there's confusion just coming from the number of difference just just the sheer number of components involved and also the fact that there's two attacks so i would i think that so i'm not sure exactly which comment you're referring to but i i would guess that you know in the second attack which i didn't you know quite describe the mechanics of yet in the second attack the attack was also financed by flash landing uh but kind of in a in a kind of dark, poetic turn, it was actually financed by flash lending from BZX itself. If you remember, in the first attack, it was a different protocol called DYDX, whose flash lending facility was used. In the second attack, BZX's own flash lending facility was used to finance an exploit of BZX. And I think probably the comment that you're referring to was...

was the BZX team pointing out that essentially it didn't matter where you got this financing for this attack, right? So BZX's flash lending facility was used to finance the second attack, but the attack would have worked regardless of where the flash lending financing would have come from, if you see what I mean. So that's why I keep calling it financing is because I'm emphasizing that the flash lending actually was not a material part of the exploit, or rather it wasn't a part of the logic that made the exploit possible. It was just a way of finding capital to do it. And that was the case in the second one, that even though it was BZX's capital that was used to do the attack, that part was basically, could have been anyone. Okay, but then for the other attack, for the first attack, that really was

due to a vulnerability in BZX. Is that what you're saying? Well, I would say that both attacks were due to a vulnerability in BZX. It's just that in the second one, it was BZX's own flash lending facility that was used to finance the exploit, uh, of that attack. But I would definitely say that in both cases, it was a deficiency of the BZX of the protocol that was attacked that allowed it to happen. So in a moment, why don't we dive into the details on the second attack? But first, a quick word from the sponsors who make this show possible. Are you interested in getting into the cryptocurrency markets but don't know where to start building your portfolio? eToro has the answer for you. It's called CopyTrader by eToro.

With CopyTrader, you can automatically copy every trade of eToro's top crypto traders at the exact price in real time. No need to study up on markets or develop your own strategies. Simply sign up and copy the trader of your choice. Any profits they make, you do too, proportional to your investment. With eToro, you get access to the world's most popular cryptocurrencies with transparent trading fees, all in one easy to use app. Copy the smart money with eToro. Join now at eToro.com. That's E-T-O-R-O. T-O-R-O dot com. Crypto.com. Have you seen the MZO Visa card?

A metal card loaded with perks. Up to 5% back and unlimited airport lounge access. They pay for your Spotify and Netflix too. What's not to love? Crypto.com has recently launched its exchange and crypto fundraising platform, The Syndicate. There was a 50% off Adam listing event on February 12th, 2020. Sign up on the Crypto.com exchange now. back to my conversation with Lev Livnev. So we walked kind of step by step through the first exploit, but can you walk us step by step through the second one? Uh, sure. So, so the, so the second exploit, um, was, you know, I think a lot of the confusion came from around the coverage of this after the fact came from, um, that when the first exploit happened, a lot of people, uh, you know, kind of looked into the history of, of, of, of

BZX and what, previous issues there had been with the smart contracts. And they found this very informative article from the security researcher Sam Sun from last year when Sam Sun found Oracle-related vulnerabilities in a number of different DeFi smart contracts, including BZX. And these vulnerabilities were all of a similar nature where it turned out it was quite common for smart contracts to make this mistake. and I can go into more detail a bit later of what exactly that problem was. But when the first attack happened, people actually assumed that it was related to, essentially to this attack vector that Sam had pointed out last year. When in fact, even though it was kind of adjacent

to it, I would say that the first attack was actually completely different. Now, the second attack was very closely related to the issues that Sam pointed out last year. So essentially the issues that he pointed out was that a lot of smart contracts, especially ones that were doing lending, had a need for oracles in order to assess the solvency essentially of positions. So to figure out if collateral value is adequate to cover the value of a loan. For this, they need an oracle for the collateral asset. and kind of is an easy way to get an Oracle. A lot of these smart contracts were looking at decentralized exchanges as a source of an asset's price in

order to value the collateral, right? And a lot of them were going to some popular decks like Oasis or Kyber or Uniswap and looking at the price there. And basically what Sam was pointing out in his article, which I kind of recommend you read if you're trying to get background on this because it's to date probably the clearest explanation of this phenomenon, I'm sure some other stuff will come out concerning these recent attacks soon, but this is a very good reference. The essence of it there is that it's, in a lot of cases, very straightforward for an attacker to do trades on one of those exchanges before calling the functionality of the smart contract that's going to use those exchanges as an oracle. And essentially, they can kind of mess up the price there arbitrarily just

before um, just before that exchange is used as an Oracle and, and, you know, manipulate it. And a lot of times they can even do this at very, very low cost. Um, so for, it turns out that for exchanges like Uniswap, you know, it's actually possible to do this in a very, very cost-effective way. So essentially it's like market manipulation, but much, much cheaper than market manipulation is usually. And that's what makes it so, so dangerous. And indeed, in the second attack, this is exactly what happened. Yeah. And actually just to jump in there, um, the first exploit, uh, apparently cost a little over $8 in network fees and the second one $110. And given the amounts of money that they made off with, clearly these fees were nominal. But anyway, keep going. Yeah. And I mean,

there's actually other costs associated with these attacks other than Ethereum transaction fees. So, for example, in the second attack, What the attacker had to do before calling into BZX is they had to do a trade. And then this trade obviously has a cost coming from a spread and a trading fee or a trading fee or so on. So there are other costs there. But yes, exactly. The point is that these costs are very small when potentially what's at stake is being able to steal BZX. almost all of the collateral or almost all of an asset that's available in one of these lending platforms. So just to make sure that we haven't still gone step by step through the second attack, but

can you use synthetics and can you just kind of walk us through how that one happened? Right. So in the second attack, there wasn't... In the first attack, the issue was that there was a kind of a safety check that was actually just incorrectly implemented and never actually properly took effect. In the second attack, it was much closer to the Oracle manipulation issue that Sam pointed out a while ago. But it turned out that the mitigations that had been put in place in order to address that, or were thought to address that issue, turned out to be insufficient. And I mean, this is where I think it gets very subtle and you really have to be familiar with how these

different exchanges work and how they're used as oracles within BZX in particular. But the gist of it is that the attacker chose to use a market for SUSD against Ether. So SUSD is Synthetix USD, which is a kind of stable coin that's created by the Synthetix protocol. And the reason that the attacker probably chose specifically that market and not any of the other markets is that Synthetix is an asset that's traded on, or this, sorry, Synthetix USD is an asset that's traded on Kyber, but has a specific property of having two Kyber reserves.

And Kyber reserves are essentially like sources of liquidity that the Kyber contract has available to use. One of which was Uniswap. So Uniswap is another exchange. And another one, which is a Kyber-specific reserve called an APR, which stands for Automated Price Reserve, which is another gadget, which is very, very similar to Uniswap. So it actually turns out that these two liquidity sources that were available to Kyber and Kyber was being used as the Oracle were actually very, very similar and could both be manipulated in a very similar way. While previously, when the mitigations to Sam's to SAAM's discovery were put in place, it was assumed that if there were multiple Kyber reserves for a given market, that they were kind of sufficiently, that

they worked in a sufficiently different way, that they would provide some level of resiliency. And this turned out to be untrue. I mean, to understand this, you kind of have to understand exactly, because these are both bonding curve-based, automated, what people call automated market makers. So, you know, pools of liquidity that set prices algorithmically based on the current position of the pool. And because both of these Uniswap and this SUSD APR were so similar, it just turned out that they would both fall to the same manipulation attack. So what's your main takeaway or is it two different takeaways from the two different attacks? Like, do you think that there's kind of, you know, one a couple

culprits that are the cause of this? Do you think that this is some kind of referendum on DeFi in general? Does it just mean that BZX needs to do a better job? What's your takeaway from what happened this past week? Yeah, well, there's actually a lot of different conclusions here. I mean, one thing is I think that I'll just point out that something that I think people are probably getting wrong, in my opinion, some of the time is kind of the role of flash lending here. In this case, in both attacks, flash lending was just a financing mechanism for the attack and was not actually materially a part of the vulnerability itself. The second thing that relates to flash lending is that a lot of people

have been saying that now we need to reconsider everything with flash lending in the game and that flash lending has really changed the smart contract security assumptions or something like that. And I think it's possible that for some... The way that some people were thinking about smart contracts was that they were assuming that malicious users or hackers basically would not be well-funded, so would not be able to find funding in order to execute attacks, and therefore you should only worry about attacks that were possible without any upfront funding. To me, I think it's clear that that was never a good assumption to make. But what flash lending does is it explicitly invalidates this assumption because now you can use smart contracts to fund your attacks in the vast majority of cases. And we discovered

this with two hacks in one week. So those are the kind of two points about flash lending that I think are takeaways for me. I think another takeaway, I haven't heard anyone kind of mention this, is that... The fact that these two attacks happened in succession, I mean, the attacks were actually completely independent of each other, right? So there's nothing about the first attack that made the second attack possible, technically speaking. And it's not like the second attack was exploiting a vulnerability that was introduced in the aftermath of the first attack or anything like that. What really happened was probably just getting more eyes on the smart contracts. That's what happened between the first and the second attacks. And it turns out that the second attack... was more or less spelled out. Well, maybe spelled out is a strong word, but was kind of heavily

suggested by some of the research that was being done on these smart contracts back in the day when Sam made those initial findings. So to me, what that means is that there's really not that many people that are actually looking at these contracts from a security point of view. And it turns out that just calling attention to the possibility of there being an issue with one of them could result, you know, in four days later in another issue being found. And it's possible that, you know, from people looking at these contracts now that even more issues will be found. I'm just speculating here. But essentially what that means is that this whole time everyone's been, no one's been really paying attention. Yeah. There's something about this that reminds me of the Dow a little bit. And granted, I'm in the middle

of writing this book. So maybe I just have the Dow in my brain a little bit too much, but You know, at that time, the reentrancy bug was talked about before the hack happened on the DAO. And here it's a similar situation where Sam wrote that blog post and, you know, someone who maybe was paying a bit closer attention was able to take some lessons from that. So, you know, I think there's probably something to be said for Sam. a lot of the people in charge of these protocols really jumping on any sort of hint of any bug that they might see, because if they don't, then somebody else will. But anyway, so thank you so much for coming on the show. And also I wanted to mention,

which I didn't get to say at the top of the hour, but you, you were the one who discovered the first exploit. So kudos to you for that. Yeah, to clarify, it was seeing the transaction where the exploit had already occurred. So it was obviously the attacker who discovered the exploit and unfortunately took advantage of it. Right. Okay. Well, either way, thank you so much for coming on the show. Of course. Thank you. Don't forget, next up is the news recap. Stick around for This Week in Crypto after this short break. Crypto.Law is run by Crypto OGs in New York who understand crypto and fintech. They were already operating in the space back in 2013 and they accept crypto as payment. One of the partners, Zachary

Kelman, is known for drafting a bill submitted to the US Congress in 2014 aimed at exempting on-chain Bitcoin transactions from US regulations. The other founding partner, his brother Daniel Kelman became well known in the crypto law space for his work in the Mt. Gox civil rehabilitation. So if you operate a fintech business or have a dispute with some person or business involving crypto, or you just need legal advice related to crypto info at Kelman.law. That's K-E-L-M-A-N.law or just go to their website at www.crypto.law. When you think crypto think Kelman. Hi everyone. Thanks for tuning into this week's news recap. First story, a close look at Coinbase's business.

Michael Del Castillo, my kind of sorta colleague at Forbes, he and I never overlapped, but I wish we had. He published a great pair of articles this week. One was a feature on Coinbase, which dived deeply into the company's business. Michael and his co-author, William Baldwin, estimate that Coinbase has been, quote, solidly in the black for several years and is on track to top $800 million in revenue this year. Plus, they know that the firm has 35 million accounts and presides over $21 billion in assets. In a related news piece, Michael reports that Visa, the credit card giant, has granted Coinbase the power to issue cryptocurrency debit cards with Bitcoin, Ether, XRP, Litecoin, Bitcoin Cash, BAT, Rep, ZRX, and Stellar Lumens as the

cryptocurrencies available on the card. The card will be available in 2021. 29 countries when it launches later this year, but the US will not be one of them. By the way, the feature story also says that according to Coinbase, it handled $80 billion of transactions last year. Michael and William say that Binance's daily volume annualizes to $1 trillion. So, speaking of Binance, next story. Binance announces new crypto exchange cloud operation. Bloomberg reports that Binance is launching a new service, lending its technology and liquidity to those who want to launch their own exchanges. CEO Shengpeng Zhao predicted to Bloomberg that Binance Cloud will become the company's biggest source of revenue in five years. Binance already has one fiat exchange,

which it will be ready to announce in the coming weeks, plus has confirmed four other clients. And Binance will offer these clients access to the order books of existing trading pairs on Binance. More exchange news. Fcoin is insolvent due to $130 million shortage in its crypto asset reserve. Fcoin, a crypto exchange that became known for its controversial trans-fee mining model, revealed that it was insolvent due to errors in its internal system. CEO Zhang Jian said in a post that the exchange had been crediting users with more in rewards than it should have. The exchange had issued an exchange token called FT, and when users pay transaction fees in Bitcoin or Ether, the platform would reimburse the

user 100% of the value in FT's. Plus, Fcoin distributed 80% of the transaction fees in Bitcoin to users who held FT's throughout the day. According to Zhang, the system began giving away more in mining rewards than users should have earned starting in mid 2018, but it didn't realize that until a 2019 audit. Next story. DOJ indictment calls operating a Bitcoin mixer or Tumblr a crime. Larry Harmon of Akron, Ohio. And so here's where I would actually normally do a shout out to Akron because this is the area that I'm from. but it somehow doesn't feel totally appropriate to do with this story. Anyway, Larry Harmon of Akron, Ohio was arrested for operating Helix, which the Department of Justice alleges laundered

over $300 million by moving more than 350,000 Bitcoin, with the largest amount coming from darknet markets. It also alleges that Helix partnered with darknet market Alphabay, which was seized by law enforcement in July 2017. Larry's brother told Coindesk that Helix, which also closed in 2017, did not directly partner with Alphabay and that the market recommended his mixer without input or permission from Larry. Next story, MIT researchers reveal flaws in blockchain-based VOTE's voting app.

MIT researchers Michael A. Specter, James Koppel, and Daniel J. Whitester found that it is possible to monitor and even change or block votes in the blockchain-based voting app VOTES, spelled V-O-A-T-Z. They also announced that the attacks could even taint the paper trail created by the app, which would, of course, make it impossible to audit. Next headline, DeFi and TBTC make it into money stuff. Yes, the crypto people who geek out about Matt Levine's columns on Bloomberg were excited when he wrote about an announced DeFi project called TBTC, which is a trustless bridge between Bitcoin and Ethereum. The TBTC website says,

quote, number one, deposit BTC, number two, mint TBTC, and three, lend and earn interest in your BTC. Project lead Matt Luongo calls this an improvement on other Ethereum-based tokens pegged to Bitcoin, such as wrapped BTC, which actually played a role in the first BZX attack and is a synthetic. He told The Block, quote, Bitcoiners want to be able to get back to the Bitcoin chain, he said. For the asset to be considered valid and theirs, they have to be able to redeem trustlessly. And a synthetic doesn't do that. As Matt Levine wrote in his column, If you want to live in Ethereum but own

Bitcoins, you can. It's like a stablecoin, which I think of as a way to live in Ethereum but own dollars. This is just a stablecoin pegged to Bitcoin. Why not? Alright, this week's fun bits. TakerDAO tells MakerDAO, expect us. Leave it to Amin Soleimani of SpankChain and MolokDAO to announce his plans to code up a smart contract called TakerDAO. Before I tell you all what Amid's plans are regarding TakerDAO, let me just mention a blog post by CoinMonks from December called How to Turn $20 million into $340 million in 15 seconds, which stated that due to the amount of MKR needed to take control of MakerDAO governance, quote, the naive cost of doing

just about whatever you want to the Maker contracts is about 80,000 MKR. Also, let me note that for just this reason, people have been watching the amount of MKR and Uniswap, which has been rising precipitously in the past couple of weeks. So with that context, here is a means description of the TakerDAO smart contract he plans to launch unless MakerDAO make some governance changes. He says it would quote, one, let people pull MKR. Two, wait until the contract has more than 80,000 MKR. Three, take over MakerDAO governance. Four, give the MKR depositors all the ETH.

And then in parentheses, you wrote $600 million. Because right now you can 9% attack MakerDAO governance. Expect us. All right. That's it for this week's news recap. Thanks for tuning in to learn more about Lev, Livnev, and the BZX exploits. Be sure to check out the links in the show notes of your podcast player. If you enjoy these news recaps, then why not sign up for the real deal? The weekly newsletter I publish every Friday. Some of you have asked me for the links to the stories I mentioned on the show, and now you can get them delivered right to your inbox. Go to unchainedpodcast.com right now to sign up.

Unchained is produced by me, Laura Shin, with help from Fractal Recording, Anthony Yoon, Daniel Ness, Josh Durham, and the team at CLK Transcription. Thanks for listening.