Marc Zeller & Stani Kulechov: Aave – Unlocking Access to Capital With Flash Loans #337

Transcript

this is epicenter episode 337 with guests Stanny kulikov and Mark Zeller hi welcome to epicenter my name is Sebastien Cuchillo today my guests are Stanny kulikov and mark seller respectively they are the CEO and integrations lead at Ave Java is building a suite of noncustodial dfi tools which allow users to earn interest on their deposits and borrow assets now one of the things which brought abate is

some prominence recently was the release of their flash loan product certainly this is something you've all heard about because in recent months there been a number of attacks on various a theorem smart contracts which have leveraged flash loans or some similar mechanism mind you as far as I know none of these actually involved the ahve flash loan contract but since we recorded this interview at HCC the bzx attack had just happened and it was pretty fresh so we did talk about it in this conversation so since their launch Ave has seen some phenomenal growth and according to the website as of today was about fifty million dollars locked in Ave which is about half of the capital and compound they support seventeen tokens a number of stable coins and they're integrated

with several wallets and apps now in terms of user experience these integrations are important because they allow users to leverage flash loans without the need to write code now this is something that we talked about in the interview as like a hopeful outlook on the future well in just a few weeks since we recorded that several codeless applications have emerged that allow people to do just that so you can now use flash loans in money Legos and literally just drag and drop different components of dphi in a user facing application and leverage a flash loan to do refinancing for example so here's what you'll learn in this interview Stanny m marks background and how they became involved in crypto the various projects they were involved with

previously including variable and why that failed the project which proceeded beiief lend and how it switched from an OTC model to the pool model that they have today we talked about yield hacking in other defy use cases we discussed what is a flash loan with it's useful for and how you can use it to do things like defy refinancing we discussed the flash lunataks which happened in February and the specifics of those attacks we talked about smart contract security and how the community should respond to attacks and why defy privacy is desirable but so hard to do so reset everything this event that I've been organizing for the last three or four weeks has come together in ways that I

would never have imagined when I first had this idea now if you remember at the beginning I had this idea to do a conference where I get like bitcoiners and the fearing people together and discuss their differences but that has totally just fallen to the wayside and reset everything is becoming has become a multidisciplinary conference about the paradigm shifts that are happening around us and that will continue to operate in society for the foreseeable future because of this crisis which is just so huge so we're gonna talk about health and wellness media and journalism money and economics tech and privacy politics and governance and work in collaboration and just look at the

website check up the list of speakers that we have for this conference I'm just blown away by the the amount of interest and enthusiasm for these topics so I'm just gonna list off a few here imesh Battaglia senior scholar at John Hopkins University azim Azhar the founder of exponential view the great newsletter which talks about long term trends in the economy and in industry brian behlendorf of hyper ledger ruth bendgate who's a historian at new york university she's gonna talk about authoritarianism and the risks of authoritarianism post Ovid Jim Bianco of Bianco research cory doctorow the author Yaya fanucci who's on the podcast recently Nick Grossman of Union

Square Ventures we've got dr. Jelena kick Manovich who's a psychologist at Georgetown University Reva tez Intel Jeff Jarvis author of what will Google do in professor of journalism at CUNY and the list goes on and on and on just check out the websites reset everything in that events it's happening on 29th and 30th oh that's another thing we got so much response for this we have to do two days instead of just one so it's on Wednesday and Thursday of this week it starts tomorrow as this drops starting at noon UTC so check out the website to get your own local timezone it's set up so that when you go to the website you see in your local timezone when the talks are happening and yeah I'm looking forward to seeing everybody

in there asking questions we want to make it interactive we want people to feel free to ask questions and ask their questions to these experts and yeah so we have about 700 signups right now and hoping to get to a thousand by the time this starts so come and join us for reset everything we'd love to see you there security audits are a vital step for building security into your systems and helping your users your stakeholders not to mention your future investors better understand security risks and being transparent about your security audits and how you're mitigating vulnerabilities well that creates confidence in your product least Authority is a security consulting company that conducts software security audits of all sizes from smart contracts to entire block chains and even if you

understand the value of a security audit well you know what that process looks like do you know how a security audit works release Authority is here to help they guide their clients through the entire process and help them demystify it and end up with a final product which is a report that you can share with your stakeholders your users and the community so if you'd like to get a better idea of what a security audit could do and could mean for your project you should join the least Authority security sessions meetup it's happening on Thursday this Thursday April 30th and you can learn how to prepare for an audit and how to identify the auditing skill sets that are important for your project to sign up go to least Authority

comm / Meetup once again that's on April 30th and there will be several sessions throughout the day to accommodate for all time zones and yes you can go to security sessions and also to reset everything now if you can't make the event for some reason you can still schedule a free no-obligation call with them so they can at least walk you through that security audit process and you can do that it's really easy just go to the website least Authority comm and there's a big red button there so you can schedule a call but do try to make the event it's on the 29th and it's free you can register at least authority comm slash meetup crypto to crypto trading has been around for a long time and shape-shift is one of the pioneers in this space back in 2014 when we were

just starting the podcast shape-shift was creating the first usable crypto - crypto trading platform that allowed you to easily swap one asset for another like Google Translate well they're still innovating bringing you products that allow you to buy crypto a fiat trade track and secure your digital assets so to sign up go to beta shape-shift comm and here you'll receive a hundred free Fox tokens these tokens allow you to trade commission free each of the tokens is ten dollars in free trading per month which means you start with a thousand bucks in free trading you can connect your ledger your treasure or your keep key hardware wallet it's totally

non-custodial and if you don't have a key P if you don't have a hardware wallet I'll tell you how can get a free one all you got to do is leave us an iTunes review go to epicenter dot rocks slash Apple or just look for epicenter in Apple podcast leave an iTunes review take a screenshot and email me at keep key at epicenter TV and I'll send you a discount code for a free keep key hardware wall alright so leave it I t's interview get a free every wallet that's the great deal right and you can also sign up at Beta chip chip calm and you'll get one hundred Fox tokens for free so you can trade commission free and with that here's our interview with Stan e kulikov and Mark Zeller I'm here with Stanny kolychev and

Matsuda and so they respectively the CEO and developer relations at Ave Ave is a defy tool that allows you to do number of things including lending borrowing and one of the things I think that they're probably most known for in the space at the moment is flash loans because they've released a flash loan product now flash loans at the moment is being discussed quite a bit I guess here at this conference and also you know on Twitter etc and we'll get into that during this interview thank you for joining me today yeah thanks for having us bestie so tell me a bit about your background and you know how you guys got involved in crypto yeah so my story is pretty

interesting uh I used to be well I'm I have always been a nerd oh yeah and basically ended up going into law school and liked rules and and so forth but I was very intrigued by finance in general more towards financial instruments and all crazy things that you could actually do and create different kinds of products and ended up finding about aetherium back in I think was 2016 beginning in Helsinki slash which was one of the biggest startup events in the

globe and I just got more interested I found the kind of like I understood the idea of smart contract technology especially like the immune ability and what it can actually bring into financial transactions and that just got me into thinking like hey we could do pretty cool stuff with this and let's do something with lending and and then we started eat land which was kind of like the the legacy of lava that was the first landing protocol and three ohm and one thing led to another and then we came the flash boys and mark just like this guy I'm in law

school drop offs but is not yet so reported be okay keep fates yeah I been involved in interim since to that 2015 my good friend Alexandra carats which is around talked to me about the this new crazy Bitcoin where you can run God on and obviously my first reaction is Watership coin and then I've been to read it and then I spent like three months day and night into the rabbit holes and we created a terrarium France with a few friends and that end up like Etsy so that's cool and I work with consensus on the valuable project we were trying to make stable

coins are based on derivative products and I work for a French broker I called coin nose that means going to be kind for the French audience very very very ingrained in the French crypto everywhere and it's my pleasure to have join just before the DEF CON at Osaka the Alpha Team for the release of their new protocol and their maintenance be following I took mark from 13 2016 with his I mean that was also kind of like a well defy project as well but mark was building the berry Bowl and it was pretty cool to actually get mark

involved in two other since Osaka and we have done Padilla cool stuff and then this guy got got the best crypto swag ever I want to ask you briefly about about variable which you were working on with our common friends he won't put a whole yeah and so you think that that product was maybe a little bit too early for its time or are there other reasons why it failed so I think we learned a lot and I think it's good for the industry I see too many reasons for valuable failure one yes it was a bit early because they are we developed that at the end of 2016

the predict was made in March April 2017 who was like even before like to be Pam a feat areum and the crypto bubbles and yeah we we had an alpha with 300 users and it was going on and I was one of them yeah but yeah a bit early and the second thing is that to tell the truth the mecca doll model turned over collateralized loans is much easier to bootstrap than the rate that you've project and I'm very happy that mega Dow prevailed in this industry because dye is a very cool product Megiddo is a great team so absolutely no regrets on my site just to stay on variables one

moment variable was building a stable coin based on on derivatives what what derivatives because I mean at the moment there's like a few derivative products in the space but what what were those derivatives are what did you intend for those to be so the main topic today is are they so let's keep it off in layman words when you have a short position and you match that with someone willing to take the option in the order other side you can create some sort of somewhat stability from that Ford users and we were better than that basically yeah not open but somewhat or on that basically when someone takes a long position

someone takes short you basically hedge that risk and you you kind of have the same thing as the overclass maker diode system with two hundred percent of worker ization and i think that the model was pretty cool it's just like for example but in that same period we were doing eteland back in the days and one of the problems we had is that we didn't have any stable points and this was the time where maker doll wasn't there that was variable actually but wasn't that life and the say USD t was on only change so it wasn't usable at all so kind of like it was the early days but i think it's just about like bootstrapping but uh one of the most

interesting projects out there that time and i am pretty sure that the same model will be launched now i mean there's a lot of derivative products coming out but pretty cool yeah I figure you would happen eventually like the situation is way better now to launch this kind of product sure yeah it seems that the ecosystem is much more mature now there's some sort of stable foundations the use cases are starting to emerge and the most important thing there's actually volume on chain now which was always the case but not that much in 2016 one thing about the volume this is something that I don't know that everyone probably understands but like

we are looking at the Dex volumes all the time and they're growing and now that we have the flash loans what people are trying to argue that you should not use let's say Dex Dex Oracle's when when you're building systems but one of the kind of issues are that the more you have the X volume the more you will have lending volume and that basically means that the ratio will be always the same and you can do always the same kind of flash attacks if there is decentralized Oracle's if you get your price from your new swap khyber there will be always this kind of like busy acts as type of attacks that we will talk about a bit shortly and I'm not sure if people understand that yet and not sure how it

will be solved actually let's let's talk about offer for a moment and talk about what you've built and what what you're solving in the space like what did you introduce to the space that wasn't there before yeah so in the very beginning well it was pretty much first landing protocol it was OTC style so whatever asset you actually have you could just collateralize and borrow against and different lenders can take the risk so after that what we actually did is we noticed that the pooled model now that we have stable coins on the ecosystem and there was successful port models for example unit swap compound we basically turned it land into Ave which meant going from order matching lending and

borrowing into pooled model where you can grab the liquidity instantly as a borrower and you can just deposit as a lender and start earning we is very powerful so just muddle sort of recap there with a pooled model you you you put all the liquidity in one pool and then exactly Boras board from that liquidity instead of matching directly like a boar with lender like exact traditional exactly and that's what's pity it was pretty much the idea of the compound model and and and that's was particularly the definer it in a narrative at that point and we wanted to expand the narrative and trying to think like how we bootstrap more liquidity because end of the day the whole web 3.0 network effect is liquidity so you get

liquidity when you know how to yield hack so the the thing that people are doing now is yield hacking how you get more yield from your protocol and that's why we see things like iron curve where people are trying to get more more APR and ap is and more yield and flash loans was part of this strategy so we introduced flash loans into the protocol to get basically more compressibility and more earnings to the depositors because all those flash loans that are executed on the there's the rest of the other guys waving so the more actually there is usage of flash loans and people are building cool products in different hackathons and we're not basically we get more yield for the depositors and

since they're rewarded to bring the liquidity we get basically more liquidity and we do this kind of like a yield hacking interesting can you explain a bit more of this yield hacking yeah give give a real-life example so I have a few length which is all native tokens and they are just sitting around so I deposit that in a V obviously because the the rates are not very high but I can use that as a collateral and one of the cheapest stable coin we have given the situation today is TUSD and US DC so I bought I used my land as a collateral I borrowed some USD C I'd swap tanks to curve and at a very low

sleep age my USD C to us DT which is teacher and that USD T I deposited in ironed out finance that's gonna switch to the yield of the of the file and and mint me some why us DT which is the tokenization of a deposit in iron and that why USD T I deposit that into a as a liquidity provider into curve so at the end of the day I borrow at five each percent some u.s. DC and I've got some new s DT deposited and I get avail yield plus the iron yield plus the kerf yield and I end up with

twenty three percent a peer so I pay 6% and I get twenty three and that's basically yield tracking and in defy when you are aware of the opportunities you can actually make money with money are there any tools that sort of like simplify this sort of I have the feeling like the iron and curve guys are the best feet in the ecosystem to create this kind of stuff yeah because right now it's all about being able to monitor and understand what are the protocols out there what are the risk because obviously when you write the yield of several protocols you also take the risk of several protocols and that's why the

tools like TV the device core are really important they give grades to the main protocols and there's also the fees up doing this kind of recipes so yeah right now it's ready manual but soon you will click one button and get them but it's kind of about it then the yield riding actually it's better than the hacking and this what actually mark explained is it's kind of like semi somehow semi simple compared to what's coming up like you might have a transaction chain of or or just different it doesn't have to be like flash modes in everything in same transaction but different kind of thing that you are going to do you might have

20 30 40 different transactions just to grab that extra yield and then you have algorithms running and doing and I think because as I previously said that the liquidity is is the network effect in India Phi there will be the developers like iron and and curve where they're building for end-users to actually take that opportunity like a lot of things what's the do you think the upside for these teams is to build these tools or actually go and exploit these opportunities what's what's the biggest upside for them I think well I haven't talked with about that with them but I think they are also liquidity providers so yeah the the more liquidity day-after

more attractive the protocol is and did they earn the same yield than everyone like when the incentive are aligned that's usually good outcomes yeah I think because like like liquid it isn't like unlimited it feels now in deify that there is there's enough funds everywhere and they're sort of kind of like people in a theory on that that have I mean are whales and with flash mobs now everyone is West well kind of like and and the thing is that it's still it will be unlimited I mean limited and you have to build for others as well to get that liquidity and it's just we can always look at the traditional financing and how the money is structured there and it's pretty much will be the same in defy what other use cases are you seeing on on have a aside

from this yield writing what if you be using a fund for well always used from for example okay the very first thing is you deposit dinner that's like the very easiest way to start doing things deposit you deposit so you have like a hundred if you deposit it and you'll you'll earn yield say from like compound or from yeah interest basically and and stable coins are pretty pretty cool things so we try to have very diverse set of stable points because they bear less risk than compared to using as a different assets as collateral so so basically try to have very diverse set of stable coin offerings and and basically on the borrower side you can deposit that say eat that your long on

and then you can basically borrow a stable coin diverge up by buying some other currency or you can just convert it to euros or dollars and spend that those funds in real life and with flash loans you can do crazy stuff like you can actually swap your collateral you if you have it as a collateral you can swap it to another quarter for example link or you can just go 5050 or whatever is the your strategy and do a bunch of other interesting things before we're talking about some of the applications for this and one of them was refinancing can you just sort of explain how one would leverage refinancing and what the opportunities there are to sort of get better rates yeah so the most interesting thing about

three points is that let's say we can take an example you have a CDP open well make it our walled and you're paying let's say hypothetically the stability fee is for example 8 percent owned I so you collateralize et borodai and now you have spent that die in real life let's say you have you have Bora Ford Focus right and then what happens is that you see that there is at 4 percent the very same amount of loan on u.s. DC but that's seen for example compound so what you could do actually you could refinance we turn returning that die alone by taking a flash loan from our web closing the CDP taking that eat that was a collateralized putting it into

compound and taking us DC and swapping that u.s. DC into died in Khyber or Eunice WAP and returning that loan back to our vet and and then you have refinanced yourself from higher interest you right to lower interest rate without returning the loan and you were super happy now I feel like we next in the video we need to have like you know borodai from from maker and then like just sort of like the steps so that people can see that's the very cool thing about an ecosystem of nerds is that all of those things all dots in Direction a very complex transaction that are based on 30 or 40 blockchain

interaction for the end-user you click on a button yes doing exactly that on karate or swap calm it's one click you don't even ask as a user to understand what exactly is happening obviously everything is auditable so if you want to dive down if you want you to understand what happened you can see and follow the trades of money but at the end of the day for the day you use your I don't even know the complexity they just know that they swap 8% burden to a four person burden and that's cool for us and what was the project in it London one bridge right yeah one bridge yeah from one inch action guys so basically were karate or swap is base

from swapping whizzing mikado and one bridge is swapping between different landing protocol so just like the example of standing so this is not science fiction this is life today on maintenance so again it's one click of the button you don't have to be an alcohol developer you don't have to understand everything about defy to actually do this today let's dive into the flash loans a little bit more so explain for our listeners what is the flash loan and for how long has this idea existed is it a new idea and defiers it existed in sort of traditional finance before yeah I think from traditional finance I mean there's occasions where you just need to borrow to settle accounts for very short period of time the very like normal stuff can

be overnight loans but there might be shorter like in in Finland we used to have we used to call this kind of like minute money where you need to open a company and you have to put two and a five five thousand euros on the account but you needed to do it for that particular visit to the bank account and then once you have done it you can return those funds to whatever you borrowed them so you actually don't need that that capital but you just need for specific transaction now in terms of the D Phi ik system there was a couple of previous iterations of flash loans and I think as a concept it's not that like new because of the I mean the atomicity of aetherium has been known from from the very GetGo

but I think what made them very popular is is that we try to Duke the flash laws to the developer community and in into the different hackathons and that's why we see people building things and getting a bit of network effect and what end up happening is that people are looking ok here's very cool thing how I could actually use to make a lot of money and and then we saw the daily hacks that exact have been done dzx so you're saying that the the recent proliferation of or the developer tools that have been built in part by Ave to make these things easily accessible you know we basically improve the developer experience by I think by second amount we also did advertise something that was

existent but very not very well marketed so to tell the truth it's during the the pzx incident that I discovered that dydx at some kind of functionality that can work like a flash loan and nobody was aware of like and we are super we are specialized in the in the ecosystem and so yeah I think we the possibility were always here but we as we develop tools that are accessible on our protocol we unleashed the creativity of developers and I think it's still early days I

think it's just we are and there's on a daily basis from 5 to 15 flash miles a day with the our protocol and and fully utilized by compressibility so it's not flash loans within our own protocol but it's actually someone Dre finances alone someone does some sort of a margin trading collateral swap and and and and whatnot an arbitrage is one of the big use cases I think mark will explain a lot of about this like we were seeing like this amount of flash loan it really reminds me like the very early days of the FOIA evil and we're like we said like small loan transactions and and and and just when things are getting bigger and there's more tools compressibility

and then we will start to see like more and more utilization and that is the very momentum where you need to think of how you reward the liquidity providers because at some point they they let's say thousand eight or ten thousand inter might not be sufficient you might need more liquidity for the flash lightning at David activity that will be happening in the a defect system so just in in avail like last night I was playing around the platform so when you go to the website you you can log in with your you web web tree wallet and you have access to the lending and the borrowing the flash loans though are are more of a developer feature like you need to write smart contract code in order to execute

this flash loan to build these transactions are you guys moving towards a product where it's more sort of click more of a user interface where people will be able to kind of compose their flash loans in the browser and so I have to answer to that the first one is we rarely see yourself as a protocol so we are really open to third-party developers and we try to echo back there basically it's my main job Attali to make her petite a proper life easier and we really embrace the the strategy that third parties can build upon our protocol adapts that do exactly that and that's basically what is already

happening like one X dot AG also done by the one inch guy allows you to use flash known to do margin trading and that's good part of the flash rom volume that exists today collateral swap all these kind of features and yeah I really have the vision of the protocol and people built upon that it's the world money Legos a toes and I do believe in that the cool part is like so many people have asked my case they're like drag-and-drop thing and to test it out and I want that yeah Peter was talking about it yesterday all day and I was thinking about this and actually Jordan

from our team was trying is trying to push really hard forward with this that someone could build build this kind of things and we have a very interesting developer community now it's growing super fast and it just I'm pretty sure that someone will boot that's pretty soon and and then basically you could just try to do different kind of like if this then that sty yeah exactly that's what we need we need like a if this and that for flash long yeah exactly Suga zap you're right nicely well I know for sure that JUnit of Finance is looking carefully at all right now and just kind of guys like has if he divides up yeah yeah definitely like a gelato is building them if this and that so the very cool sign that this

is happening is that we have to remind ourselves that the protocol is live for two months like only two months it's brand new like it just came out in only two months we already have like several cool life project right now on maintenance that you can use one click of a button that tells something about the developer community that we we are part of like people are actually looking at the codes I have like dozens and dozens and dozens androids of telegram groups with developers that are actually building every two weeks we do the integration recap and there's new stuff happening every day this all yeah it's gonna happen and I think they're like

the corner of us Bob actually was born in a way that I was brainstorming in telegram with Mariano Conte and saying hey man how does the collateral changing can I open like a position with a little bit of DAT and a little bit of heater like Christian meter collateral and Mariana said that that's basically not super at this moment and and I was thinking well actually you could use flash was probably to do this and we're brainstorming a moment and then I made a tweet about this hey actually this one could use case for flash loans that you could actually do and this kind of like collateral swap and then a spy can someone build this thing and then what there was David actually from our community well just Cape later to our community but with the Carell swaps but

basically what was funny is that he said hey this looks interesting I will try to actually build this thing and then he'd just build it and don't yeah and there's like people are using it so it's just like it's very cool like period not just like for flash alone but for us as well like to experience like how many people are like interested in trying to do different kinds of things that's just pretty cool interesting let's switch gears a little bit and talk about this this recent attack which which happened just a few weeks ago over during East Enver yeah describe sort of what happened let's pull out the scenario of how this attack was discovered and and then we can I guess dive into the more ethical philosophical how many

attacks - well - to the best of my knowledge yes you know it was a trial yeah yeah the the first thing I want to say on this subject is that it's not an attack on avi like sometimes we can see a UH because it was used no no never knew so it's not an attack on avi so avi was not act yet did some common confusion flash loan from avi was not used so basically they used the ninja loans so I don't know the name the use of dy/dx which is kind of flash loans but a bit more limited because you can only do it I think in the platform and

something like that and the second attack was the flash loan from dzx so they add some flash on somewhat so and they use that because BTX did not have reentrant see Prevention's building in the protocol so basically if you want to use ave flash loan and use that liquidity inside of a protocol or a smart contract architecture doesn't allow you to do that because obviously you can do like some kind of like circular logic issue and that's a bad practice to do that and they did not have that and that was basically the

second lock so you can you talk about the the specific attack and sort of how that role how that played out like the the different steps or the different like transactions in the in the attack and how it was leveraged to walk away with a couple hundred thousand dollars the first one was pretty straightforward so basically they took a flash long innate and and basically converted to I think W BTC was it that way and and then they pushed the price down in in the decent was exchanges which affected basically the price of unis flop to to punch on a WB to see and at the same time half of the funds that the attacker had he basically took a leveraged position in

BC ax so he basically broke tab it there Oracle there and and made money at the same time with the short position that was leveraged and and then that was a pretty much about it so they the kind of challenge is that the in busy acts they took the prices from this interest exchanges fiber which also routes stuff to the unit swap and when the price was pushed down basically that was the moment when problems happen and because they had a short position on leverage which basic means that they need less money to to gain more money they basically exploited this situation the the situation that they exploited had to do I mean mostly with the fact that the

price feed on unis swap for W BTC there was only one price field I believe right and so it's more about liquidity it's not a uni swap like the v1 of you know swap doesn't really have a price feed like the smart contract of unit swap are pretty simple in term law of architecture so basically the only job of unit swap is to keep 50% worth of one asset and three t person worth of the other asset no matter the amount of units of asset a and B and the only way unit swap define the price is to market making opportunities arbitrage opportunities so if the price is higher

or lower on Eunice web than other platforms like they bet and that people will take advantage of that to actually make money through elaborate rush and obviously when there's opportunity to make money usually there's someone to take it so it does work but I will not say that you need to about any kind of Oracle of private because it's like a sender arbitration base price speed okay but where was the where was the the server because I so the the WBT see liquidity on unit swap is quite low so you don't need that much money to okay to change affect the price a lot okay I thought there was something to do with

with price fees at some some point there it's the Wade physics understand the price of a WBC and if you can manipulate somewhat easily the price on uni swap and Yoona swap it's part of the price feed then you can manipulate the price on busy eggs and take profit out of that okay thank you nice is the other way around okay yeah I understood it's not exactly this that means a simplified version of what happen what was the reaction and to this attack and you know what was the your take on what this sort of signals for the space generally yeah I think that the very big reaction it was I mean if you look at the big picture it was

basically there's risks in deify and system are being built not properly audited and and the thing is that there t v-- also which is like the total locked value of a smartphone shock of a specific defy protocol they're growing a lot like every protocol has been growing substantially and thing is that when you have more and more this asset under management what you need to do is is put more diligence and more outlets and into the code and in this case also like especially the second attack by the way there was actually a third attack but it happened couple of months before so in busy access wall that was the one inch guys actually exposing exposing it so

what in the second was funny is that they will say are for implementation of the flash moans in that particular protocol and and they got flashed themselves and it just shows that even though duct innovation that needs to be put into the space to keep it growing and keep it like moving forward it has to be done very carefully because you need to have really good protocols and the risk us are too high and it just takes one protocol to go bust to lose the whole fate into the space and take two years to people regain interest again like we had with the the dow hack we have to remind yourself that this is not the beginning of 2018 anymore like this real announced in defy 1 billion a

bit less due to the markets right now but around a billion dollars like we we are 28 million under our protocol yeah and audits textile audits are painful or two and they're expensive and they are crazy expensive like nobody takes all it's for friends but if we do it it's because we the safety is always off our users and the securities of top priority it causes a barrier to entry that projects can I mean I know this was talked about last night at your event that the thing is like with the security that has been put in I mean I think office budget is like half a billion a year on smart contact already Solway so it's it's and it's just growing and I

don't think where it's the kind of like a cap and prices aren't going any any lower and we kind of have the responsibility to take more put more effort to make sure that we have done things right and that raises the barrier so in one way like the fashion loans they're kind of far reducing the barrier to enter and create products without liquidity it's very difficult to overcome the security challenges and I think that's that is a barrier and it becomes even more difficult to enter into the device base quite agree on that I'm curious if you have any thoughts about who are the losers here like of course we can talk about like the funds that were that were taken and but do you think that the the sort of the space

keeps taking a reputational hit every time this happens or or is it you know protocols that are not well audited and I mean one thing that I was thinking about last night is this is maybe like a relatively new type of attack you know do do audits even pick up this this sort of thing or is it you know when they happen that that all of a sudden now like smart contract auditing forms are are looking at this specific type of attack and mitigating it yeah because I mean like the attack itself kind of existed because if you have the liquidity you could do the same trick but are now everyone like that's mark you wrote previously like now used to have like nerds and now you have like nerds with way like liquidity and now

you can actually perform that with technical knowledge those kind of attacks but I think every kind of like a hit is also an opportunity to show like how things will be like how the aftermath is treated how you communicate message and how you can improve things and raise standards so every hit is also like opportunity to make things better and more resilient and thinks right yeah we we all have to learn in the context of is it too expensive to to build on defy right now because you have to out it I want to remind also that's compared to the state of a terrarium in late 2015 or 2016 there's been a lot of job into standardization so basically let's say

to be the example right now building your C 20 you go to opens and clean the contract out there it's like copy paste in 2016 that was not as much the case just under your C 20 was already there but the tools were not as good as today and I think we are growing like more and more staff a standardized there's more and more open libraries there's more and more code you can build upon like safe code or TT called use codes tools from the community so it's easier and easier to get started but yes audits are really expensive but every dollar spent there are well spent exact wisely Spencer we accept that

price gladly exactly and I what I like to read in in marks also I thought is that what's interesting that you don't need to build actually in infrastructure layer you don't need to build a like another Ave or another compound because like you had the Institute infrastructure providers already the way you can get the liquidity and basically there's the application layer where you can build load of cool stuff and with with more a quicker way and you don't need to have the of course you need to have very hard like high security but basically it's not the same as in infrastructure smart contract levels so in kind of like noting that that you can still be a developer make a cool hack in

in like places like it London and so forth and actually just create a new product that people will use and that get audited and I think simplicity is the key we're building a lot of complexity but uh which is to find simple ways to build very interesting things for example a rate writer like I earned that finance we are big fans of what Andre do when you look at the code well it's not easy to build that obviously but it's not that complex as an architecture because he leveraged upon several protocols and just switch the money around obviously you have to build things securely but I think third-party disrepair can build the

money labels like build new layers or neck 16 protocols just like you say yeah and Andre is a very smart guy I mean what he built is pretty cool stuff and I mean the thing is he's a 1/1 man theme and and basically there was a trade which had a lot of slippage and was not a hack and and I think there was a lot of people from the community just like attacking and asking hey what's happening here I'm probably not even like users but actually just people from the community and and there was like lot of hysteria and he wrote a blog post like why building and defly sucks because like you tried to do everything and and then people expect that you're 24/7 customer service representative at the same time and you're a developer and

and debugging everything and we are building financial products I mean we if you're pushing something out there we we need to understand that as well but also it kind of shows that how much we have to grow as a people and have better human composability exactly we have to be better human beings and we have to learn the difference obviously if something happened with avi where it's my job to response it's my job to be there I'm on payroll and I'm really interesting to Harvey and I'm gladly on 24 hour service to respond to to anything that may happen but Andrei is not nobody payroll nobody pays for his service like it's one guy yeah like were coding day and night to offer earth free

service to have like great year like the best Pro yield on defy and if the only answer yard is like you your support is not good enough your platform is not safe enough well obvious is gonna step back from the ecosystem and that's we all lose from that and yeah I want to express my support to this guy and all the guys that are trying to build upon protocols and um defy you are welcome here and we will do everything we can to support you guys and mercury is very good thing that because like what we're doing Nava and we're doing infrastructures level things we kind of have to be very careful how we build things and and and put a lot of

diligence because we we also know that there's sort of institutional's coming into the space and looking at the protocols and wanting to engage with them and and basically to make sure that we can onboard different-sized and institutions they really need to feel comfortable even though they're using it process technology that they can verify instead of trusting there you're always running a brand game yeah and just to finish on that subject what happened on iron could have happen in a low liquidity pool of unislope like the exact same scenario if you bring too much liquid in the low leak too much money in our assets in lower liquidity pools you will have a huge slippage it's a not a bug like it's a feature the bug

is that it did not implement slippage alerts but slippage our layout I'll stand out for like six months in the ecosystem it was not something for the for a huge time indie fight and nobody at all it was a huge issue so no bugs so just to end on this attack and then I want to move on to something else you know there's been some discussion around whether or not this is ethical and I think we've had similar discussions around things like the Dow hack around the parity bug and I like to ask you if you think these things are permissible you know if the code allows for it are you of the opinion that sort of code is

law or other more ethical questions that we one should ask around these sorts of things one thing we should ask with this question usually like is the court of law it's also kind of like do we want to create something new or or also like follow the old or something within in between because the coated slice is pretty new thing I mean if you think about like I mean if you do a hack you hack a database you steal a bunch of details money you commit a felony and and in that case what it basically means that you have consequences and if code is law and it permits to do that kind of thing that's pretty fine if that's agreed I mean in contractual you can agree whatever almost but the thing is in that case it would create pretty

interesting dynamics as I was mentioning about the kind of like creating the Robin Hood hackers who are just hacking protocols making them more resilient but also they will walk away with the funds so the consequences can be devastating as well and I'm not sure that people will defy users or the general public would actually be ok with that at least this point this to answer to that for me I like unchain yeah god is low because the protocol should be permissionless we should not have kyc at the protocol level we should treat everybody equally with exactly the same rule defined by the protocols defined by the codes but I want to remind everyone that Lou is an actual thing in the

mid-back ecosystem like we're in the physical worlds there is low there's informants there's your addiction so if you commit unchain a felony and that is proven to be a felony you might have to face legal consequence and that's two separate things that doesn't mean we don't have law enforcement on Shane at the protocol level that we cannot have it of shame and I will also like to say that there is a good saying by basically I think it is it seems he that the basic software is hitting toward and I like to sometimes think that at some point the law will lead the software I mean because like things will happen on chain that the people will either not expect or there will be just so devastating

consequences that you have to do something or have someone basically take the consequences and I think governance itself is a very very good tool if you think about governance I mean on chain governance where people can vote good decision can be made and there's a very good history in in the ether room space where something has happened or or you have to make decisions and the etherium as a community comes up steps up and basically making decisions that they feel that are rationally the best wants to do at this point to go further from from that particular moment so I definitely think that if you want flexibility governance is the key and you have to have a way to govern your protocol and that's like something that we are now working at of it like how we

can make sure that this protocol that it's open source that we are giving to the public how again all the stakeholders that are involved with the token omics and governance can actually participate and and we have measures to follow if something big happens less than switch gears here and talk a little bit about privacy and I'll start by asking you you know why would we want privacy in defy so just just to disclaim Amy and Mark we are privacy experts right obviously well at least the up the trust community up say so we have a lot of badge of privacy some oh no but I mean so last night you spoke on a panel

about about privacy in defy and you made some interesting points and I think that one of the things that a lot of people don't consider is so the technical and design challenges around having privacy and defy and I'd like to get your thoughts on you know what are those challenges and how are they different from you know applying privacy safety layer one like you know for something else we with a reminder we are trust less permissionless protocol so basically if you want to use our they we you don't have to to ask the permission to anyone you have a web tree wallet you have assets you can interact directly with the protocol even or up it just the front end if you want to interact with

the smart contract you can find them very easily online and interact directly we don't know at all who are your or users for its it just addresses so obviously it certain emails like law enforcement can do some chain analysis and end up finding the guys but we are not doing this work for us and it's really important for us to to be as natural as possible because we offer a technology as a protocol yeah and that's a that's a good point because I the kind of like accountability so if you see everything in the public ledger that's big that's that's one of the coldest inks ever so basically you actually see if there's any disparen see under comic radical decisions you will

see like lending rates of each unchain protocol and trades and everything so you can actually like the coolest thing about the whole like it's idiom bulk chana at this moment is that like it's audible by anyone but as we are moving more and more into this kind of like a defy economy we're getting basically paid salaries and stream salaries in crypto we're getting payments we're doing interactions people are like starting to see what's kind of like a financial profiles we have and that's also something that we want to get away from like we are coming from a era where we have tech giants using our data and selling that data and selling our attention and in basically making profit out of it and we want to go away with

that and that's like why privacy is very important and that's like from technical perspective it's not easy to do and also privacy smite might be not something that everyone needs now that's why I like what we are looking at privacy and working at our base is basically to apply that privacy technology is like at stake into the lending pool structures so if there are people who want privacy we have separate pool for that and where the assets are and transactions are sealed and then we have a more general pool and just like customized things and that pulls down of having different kinds of offerings and different kinds of pool for various reasons and privacy is one of these reasons so how does that work the private pool so the cool part about the Ave protocol is that we have a

pool manager contract so basically we can create different kinds of pools and we're based on the tech anomic those pools are governed what kind of assets we can inject into this other protocol and in different pools and and how they will be insured in the future for example if there's different kinds of bank run risks and so forth so what is the cool part is that with the same smart contract infrastructure you can create completely new pool and by the governance you can decide for example what kind of assets you could basically inject into this particular pool and to have privacy's you could basically create another alternative pool to what we have and basically use zk based assets there for example ZK a die so if you deposit ZK die you get in return z k8 I and

other ZK based assets so that's like something that we're doing like a lot of research at the moment and and I think that will be very cool experiment this is similar to the concept of a dark pool dark pool is more about kind of like a OTC market place but the cool thing about dark pool is that the reason where people go to see they want to bank large trays so if they want to sell or buy and also that they want to hide their liquidity from the market and not affect market movements and I think dark pools I mean privacy technology in dark pools is important if you want to achieve one of the biggest goals there so I would say it's like a big dark lending pool which should actually name it like dark

dark of a pool or something black goes there that goes and to roll back to the GK a die I think it's like I'm really interested into that project and I hope it will come to light on main netting in the next few weeks or at least months because to me it's the ultimate form of online cash because it's one to one with the dollar because one a dye is always what a dye and its growth directly into your wallet so it's interest bearing it's also private and yeah it's like the perfect tool for online money do you think that that privacy is is something that the

theorem space is focusing enough on and specifically with regards to defy do you think that the defy space is focusing enough on on privacy or would you like to see more efforts there I think you know that this month yeah not as message at this moment and that's where you understand the difference between several blocks an ecosystem like for example in Bitcoin there are you they have like so many cool tools they are wasabi they have Samurai wallet we are cool they have the conjuring the protocols they have so many stuff and if you to mix your coin on Bitcoin you just download the samurai wallet and you do it from your wallet it's super easy to join a pool super easy to make super easy to spend super easy to deposit your

Bitcoin and go to the Lightning Network between Israeli focus on that I will say as the opportunities to build things are wider in each area the focus is not as much directed into privacy I do believe it will happen eventually because right now it's magic internet money for a lot of person but since we have the stable coins and stable Cola be going more and more thing we starting to understand well if you look at my ENS address that is very easy to find you will see exactly how much I earned at our every month you can check my address and you can know my salary yeah and I could be like that way a copy mark strategies and

only on yield hacking you can do so like front Ronnie you can do of course like you can look at one salary or figure out like you know ones positions on things but like you you can also copy strategy so someone could build the system whereby they're like scanning the blockchain figuring out which strategies people are executing and you have sort of like you build like a decentralized eToro copy trader type type of function result the disk on fault [Laughter] like the protocol is working on that pretty cool stuff that you can you can

basically follow orders and the social trading is pretty pretty neat that they came up with it then they're actually thinking about utilizing flash mobs for for basically closing a reopening position so I think the whole space is exploded with the flash loans and I just can't wait to see a more more stuff but in terms of the the the privacy and what you what you can do there are sort of issues especially in trading with the with the front-running for example that if you have some interesting transaction that you want to prefer and someone basically scans it and just France France your transaction and and I think it's becoming I even like a business I keep hearing that okay I wanted to make a transaction and someone front run at me and that's very it happened to me you know other

contexts in the Clara's context and basically yeah they are doing like generalized frontrunner scripts that monitor the Italian main polls and front one knew if the trade is profitable to them that's somewhat an issue for Italian in midterm that can turn into issue not a real issue right now that can turn into an issue but obviously the good thing is that that can be mitigated you you can create some kind of on imports factor an election and do some beating gas words like there's a lot of stuff that can happen that yeah it's quite interesting this ecosystem where everything is on the table like it's a

brand new thing that never happened in traditional finance like nobody was aware of every single transaction I don't know if you will turn into a dystopia or not I like all the opportunities are open at this space there are so many cool things you know and I just like we can't even imagine what's happening like within a few months because things will change a lot I mean it's just it's a space it just keeps evolving and evolving that's that's that's the coolest part here so one final question before we wrap up here and this kind of comes back to what we were talking about earlier and you know we did touch on it a little bit but I'd like to get your thoughts on the speed at which things are evolving and

obviously that that has you know many positive effects because we're seeing like a proliferation of applications that there's a lot of innovation and people are doing really cool things and building like a lot of really really cool things and that's happening here at this event and you know just in the last month with like eath Denver eath London and now like ECC there's just like all have new new stuff being built so that's really cool and it's like it's interesting to see that but at the same time there are risks to that and like one of the one of the risks is attacks like this one or others you know the many other types of attacks that have had and then past what advices you would you have to give to the space with regards to you know how the ecosystem as a whole should innovate yet at the same time be

cautious say of overzealousness and moving a little bit too fast perhaps where we end up in situations where types of attacks like the one we talked about can happen or we fall into a dystopia or people are arrested by the I was talking to John Shipton Julian Assange his father yesterday and you know where he talks about a situation where if people in the Theorem space are building things that go against the interests of say governments like the u.s. well they can get extradited just like there are many sort of computer scientists that are facing extradition to the u.s. at the moment Julian as well like yeah III think like that's the thing that's the

thing we're building things maybe a bit too fast but uh innovation is something you can't you can't slow down easily and you shouldn't be able to slow me down because that's in your interest but the thing is like part of that innovation like the security is very important and also like if you look at the whole regulation in space that's like that's the next thing I mean now all the dfi protocols they are building two boards more decent right direction or journey there are protocols with admin case for example but still they have a like a plan to be more decentralized and they have a reason for it so there are a few decisions where you basically might have a safe harbor for a protocol that is sufficiently decentralized so it's a void certain type of regulation and I

think people are not building towards that direction and if there is will be in the future this kind of safe harbor when this kind of like greatness of regulation goes out and there's more clear rules what will be interesting is that a completely new economy will be born but if you go to a same pad where basically everything needs to be KY seed and and everything will become very very regulated we actually are just having running very expensive my sequel databases and that's not the kind of thing what you can achieve with define and the book chain technology that's not what I signed up for I want out if that happens yeah yeah that's why it's really important to keep the vetoes we are the sunrise and

permission a snow K we see obviously on those money Legos well you can build a layer to lay your tree and something that has a great UX you can put your passport in and down the way it's the money and Sprite who are they and and there's new Maidan means at the end of the day is the first time in financial history that people have choice if you want to deep dive and understand what is Webb tree you don't have to use that fancy easy thing that takes some commission and you can download Webb tree and go directly to into other and we have the choice and that's brand new and we should embraced it cool that's great note to end on thank you for

joining me today and the booth yeah and enjoy the rest of the conference thank you very much thank you for joining us on this week's episode we release new episodes every week you can find and subscribe to the show on iTunes Spotify YouTube SoundCloud or wherever you listen to podcasts and if you have a Google home or Alexa device you can tell it to listen to the latest episode of the epicentre podcast go to epicenter TV slash subscribe for a full list of places where you can watch and listen while you there be sure to sign up for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us guests or other podcast listeners you can follow us on twitter and please leave us a review on iTunes it helps to be behind the show and we're always happy to read them well

thanks so much and we look forward to being back next week [Music] [Music]